Identifying multiple nodes in a virtual network defined over a set of public clouds to connect to an external SaaS provider

ABSTRACT

Some embodiments establish for an entity a virtual network over several public clouds of several public cloud providers and/or in several regions. In some embodiments, the virtual network is an overlay network that spans across several public clouds to interconnect one or more private networks (e.g., networks within branches, divisions, departments of the entity or their associated datacenters), mobile users, and SaaS (Software as a Service) provider machines, and other web applications of the entity. The virtual network in some embodiments can be configured to optimize the routing of the entity&#39;s data messages to their destinations for best end-to-end performance, reliability and security, while trying to minimize the routing of this traffic through the Internet. Also, the virtual network in some embodiments can be configured to optimize the layer 4 processing of the data message flows passing through the network.

CLAIM OF BENEFIT TO PRIOR APPLICATIONS

This application is a continuation application of U.S. patentapplication Ser. No. 17/233,427, filed Apr. 16, 2021, now published asU.S. Patent Publication 2021/0234728. U.S. patent application Ser. No.17/233,427 is a continuation application of U.S. patent application Ser.No. 16/192,780, filed Nov. 15, 2018, now issued as U.S. Pat. No.10,999,100. U.S. patent application Ser. No. 16/192,780 is acontinuation-in-part of U.S. patent application Ser. No. 15/972,083,filed May 4, 2018, now issued as U.S. Pat. No. 11,005,684. U.S. patentapplication Ser. No. 15/972,083 claims the benefit of U.S. ProvisionalPatent Application 62/566,524, filed Oct. 2, 2017. U.S. patentapplication Ser. No. 17/233,427, now published as U.S. PatentPublication 2021/0234728, and U.S. patent application Ser. No.16/192,780, now issued as U.S. Pat. No. 10,999,100 are incorporatedherein by reference.

BACKGROUND

Today, a corporate enterprise network is the communication backbone thatsecurely connects the different offices and divisions of a corporation.This network is typically a wide area network (WAN) that connects (1)users in branch offices and regional campuses, (2) corporate datacentersthat host business applications, Intranets and their corresponding data,and (3) the global Internet through corporate firewalls and DMZ(demilitarized zone). Enterprise networks include specialized hardwaresuch as switches, routers and middlebox appliances interconnected byexpensive leased lines, such as Frame Relay and MPLS (multiprotocollabel switching).

In the last several years, there has been a paradigm shift in the waycorporations serve and consume communication services. First, themobility revolution has allowed users to access services from any placeat any time using mobile devices, mostly smart phones. Such users accessthe business services through public Internet and cellular networks. Atthe same time, third-party SaaS (Software as a Service) vendors (e.g.,Salesforce, Workday, Zendesk) have replaced traditional on-premiseapplications, while other applications hosted in private datacentershave been relocated to the public clouds. While this traffic is stillcarried within the enterprise network, a significant portion of itoriginates and terminates outside the corporate network perimeters andhas to cross both the public Internet (once or twice) as well as thecorporate network. Recent studies have shown that 40% of corporatenetworks report that the percentage of backhauled traffic (i.e., ofInternet traffic observed in the corporate network) is above 80%. Thismeans that the majority of the corporate traffic is carried over bothexpensive leased lines and the consumer Internet.

As a consumer-centric service, the Internet itself is a poor medium forbusiness traffic. It lacks the reliability, QoS (quality of service)guarantees and security expected by critical business applications.Moreover, the ever-increasing consumer traffic demands, net-neutralityregulations and the creation of Internet bypasses by major players(e.g., Netflix, Google, public clouds) have lowered the monetary returnper traffic unit. These trends have reduced the incentives of serviceproviders to quickly catch up with the consumer demands and offeradequate business services.

Given the growth of public clouds, corporations are migrating more oftheir compute infrastructure to the public cloud datacenters. Publiccloud providers have been at the forefront of compute and networkinginfrastructure investment. These cloud services have built manydatacenters across the world, with Azure, AWS, IBM and Google expandingto 38, 16, 25, and 14 worldwide regions respectively in 2016. Eachpublic cloud provider has interconnected its own datacenters by usingexpensive high-speed networks that employ dark fiber and undersea cablesdeployed by submarines.

Today, notwithstanding these changes, corporate network policies oftenforce all corporate traffic to go through their secure WAN gateways. Asusers become mobile and applications migrate to SaaS and public clouds,corporate WANs become costly detours that slow down all corporatecommunications. Most corporate WAN's traffic is either sourced from ordestined to the Internet. Alternate secure solutions that send thistraffic through the Internet are not adequate because of their poor andunreliable performance.

BRIEF SUMMARY

Some embodiments establish for an entity a virtual network over severalpublic cloud datacenters of one or more public cloud providers in one ormore regions (e.g., several cities, states, countries, etc.). An exampleof an entity for which such a virtual network can be established includea business entity (e.g., a corporation), a non-profit entity (e.g., ahospital, a research organization, etc.), and an educational entity(e.g., a university, a college, etc.), or any other type of entity.Examples of public cloud providers include Amazon Web Services (AWS),Google Cloud Platform (GCP), Microsoft Azure, etc.

In some embodiments, high-speed, reliable private networks interconnecttwo or more of the public cloud datacenters (the public clouds). Someembodiments define the virtual network as an overlay network that spansacross several public clouds to interconnect one or more privatenetworks (e.g., networks within branches, divisions, departments of theentity or their associated datacenters), mobile users, SaaS (Software asa Service) provider machines, machines and/or services in the publiccloud(s), and other web applications.

The virtual network in some embodiments can be configured to optimizethe routing of the entity's data messages to their destinations for bestend-to-end performance, reliability and security, while trying tominimize the routing of this traffic through the Internet. Also, thevirtual network in some embodiments can be configured to optimize thelayer 4 processing of the data message flows passing through thenetwork. For instance, in some embodiments, the virtual networkoptimizes the end-to-end rate of TCP (Transport Control Protocol)connections by splitting the rate control mechanisms across theconnection path.

Some embodiments establish the virtual network by configuring severalcomponents that are deployed in several public clouds. These componentsinclude in some embodiments software-based measurement agents, softwareforwarding elements (e.g., software routers, switches, gateways, etc.),layer-4 connection proxies and middlebox service machines (e.g.,appliances, VMs, containers, etc.). One or more of these components insome embodiments use standardized or commonly available solutions, suchas Open vSwitch, OpenVPN, strongSwan, and Ryu.

Some embodiments utilize a logically centralized controller cluster(e.g., a set of one or more controller servers) that configures thepublic-cloud components to implement the virtual network over severalpublic clouds. In some embodiments, the controllers in this cluster areat various different locations (e.g., are in different public clouddatacenters) in order to improve redundancy and high availability. Thecontroller cluster in some embodiments scales up or down the number ofpublic cloud components that are used to establish the virtual network,or the compute or network resources allocated to these components.

Some embodiments establish different virtual networks for differententities over the same set of public clouds of the same public cloudproviders and/or over different sets of public clouds of the same ordifferent public cloud providers. In some embodiments, a virtual networkprovider provides software and services that allow different tenants todefine different virtual networks over the same or different publicclouds. In some embodiments, the same controller cluster or differentcontroller clusters can be used to configure the public cloud componentsto implement different virtual networks over the same or different setsof public clouds for several different entities.

To deploy a virtual network for a tenant over one or more public clouds,the controller cluster (1) identifies possible ingress and egressrouters for entering and exiting the virtual network for the tenantbased on locations of the tenant's branch offices, datacenters, mobileusers, and SaaS providers, and (2) identifies routes that traverse fromthe identified ingress routers to the identified egress routers throughother intermediate public-cloud routers that implement the virtualnetwork. After identifying these routes, the controller clusterpropagates these routes to the forwarding tables of the virtual networkrouters in the public cloud(s). In the embodiments that use OVS-basedvirtual network routers, the controller distributes the routes by usingOpenFlow.

The preceding Summary is intended to serve as a brief introduction tosome embodiments of the invention. It is not meant to be an introductionor overview of all inventive subject matter disclosed in this document.The Detailed Description that follows and the Drawings that are referredto in the Detailed Description will further describe the embodimentsdescribed in the Summary as well as other embodiments. Accordingly, tounderstand all the embodiments described by this document, a full reviewof the Summary, Detailed Description, the Drawings and the Claims isneeded. Moreover, the claimed subject matters are not to be limited bythe illustrative details in the Summary, Detailed Description and theDrawing.

BRIEF DESCRIPTION OF THE DRAWINGS

The novel features of the invention are set forth in the appendedclaims. However, for purposes of explanation, several embodiments of theinvention are set forth in the following figures.

FIG. 1A presents a virtual network that is defined for a corporationover several public cloud datacenters of two public cloud providers.

FIG. 1B illustrates an example of two virtual networks for two corporatetenants that are deployed over the public clouds.

FIG. 1C alternatively illustrates an example of two virtual networks,with one network deployed over public clouds and the other virtualnetwork deployed over another pair of public clouds.

FIG. 2 illustrates an example of a managed forwarding node and acontroller cluster of some embodiments of the invention.

FIG. 3 illustrates an example of a measurement graph that the controllermeasurement-processing layer produces in some embodiments.

FIG. 4A illustrates an example of a routing graph that the controllerpath-identifying layer produces in some embodiments from the measurementgraph.

FIG. 4B illustrates an example of adding known IPs for two SaaSproviders to the two nodes in the routing graph that are in datacentersthat are closest to the datacenters of these SaaS providers.

FIG. 4C illustrates a routing graph that is generated by adding twonodes to represent two SaaS providers.

FIG. 4D illustrates a routing graph with additional nodes added torepresent branch offices and datacenters with known IP addresses thatconnect respectively to two public clouds.

FIG. 5 illustrates a process that the controller path-identifying layeruses to generate a routing graph from a measurement graph received fromthe controller measurement layer.

FIG. 6 illustrates the IPsec data message format of some embodiments.

FIG. 7 illustrates an example of the two encapsulating headers of someembodiments, while FIG. 8 presents an example that illustrates how thesetwo headers are used in some embodiments.

FIGS. 9-11 illustrate message-handling processes that are performedrespectively by the ingress, intermediate, and egress MFNs when theyreceive a message that is sent between two compute devices in twodifferent branch offices.

FIG. 12 illustrates an example that does not involve an intermediate MFNbetween the ingress and egress MFNs.

FIG. 13 illustrates a message-handling process that is performed by theCFE of the ingress MFN when it receives a message that is sent from acorporate compute device in a branch office to another device in anotherbranch office or in a SaaS provider datacenter.

FIG. 14 illustrates the NAT operation being performed at the egressrouter.

FIG. 15 illustrate a message-handling process that is performed by theingress router that receives a message that is sent from a SaaS providermachine to a tenant machine.

FIG. 16 illustrates such TM engines that are placed in eachvirtual-network gateway that is on the virtual network's egress path tothe Internet.

FIG. 17 illustrates a double-NAT approach that is used in someembodiments instead of the single NAT approach illustrated in FIG. 16 .

FIG. 18 presents an example that illustrates the source port translationof the ingress NAT engine.

FIG. 19 illustrates the processing of a reply message that a SaaSmachine sends in response to its processing of a data message of FIG. 18.

FIG. 20 presents an example that shows M virtual corporate WANs for Mtenants of a virtual network provider that has network infrastructureand controller cluster(s) in N public clouds of one or more public cloudproviders.

FIG. 21 conceptually illustrates a process performed by the controllercluster of the virtual network provider to deploy and manage a virtualWAN for a particular tenant.

FIG. 22 illustrates a three-layer SaaS deployment model of someembodiments.

FIG. 23 illustrates a two-layer SaaS deployment model of someembodiments.

FIG. 24 illustrates a process used by the central controller cluster ofsome embodiments to define routes for a multi-homed, multi-machinecompute node (MMCN).

FIG. 25 presents an example of two branch nodes of two MMCNs and a SaaSdatacenter.

FIG. 26 illustrates a process used by the central controller cluster ofsome embodiments to define routes for multi-homed SaaS providers.

FIG. 27 conceptually illustrates a computer system with which someembodiments of the invention are implemented.

DETAILED DESCRIPTION

In the following detailed description of the invention, numerousdetails, examples, and embodiments of the invention are set forth anddescribed. However, it will be clear and apparent to one skilled in theart that the invention is not limited to the embodiments set forth andthat the invention may be practiced without some of the specific detailsand examples discussed.

Some embodiments establish for an entity a virtual network over severalpublic cloud datacenters of one or more public cloud providers in one ormore regions (e.g., several cities, states, countries, etc.). An exampleof an entity for which such a virtual network can be established includea business entity (e.g., a corporation), a non-profit entity (e.g., ahospital, a research organization, etc.), and an educational entity(e.g., a university, a college, etc.), or any other type of entity.Examples of public cloud providers include Amazon Web Services (AWS),Google Cloud Platform (GCP), Microsoft Azure, etc.

Some embodiments define the virtual network as an overlay network thatspans across several public cloud datacenters (public clouds) tointerconnect one or more private networks (e.g., networks withinbranches, divisions, departments of the entity or their associateddatacenters), mobile users, SaaS (Software as a Service) providermachines, machines and/or services in the public cloud(s), and other webapplications. In some embodiments, high-speed, reliable private networksinterconnect two or more of the public cloud datacenters.

The virtual network in some embodiments can be configured to optimizethe routing of the entity's data messages to their destinations for bestend-to-end performance, reliability and security, while trying tominimize the routing of this traffic through the Internet. Also, thevirtual network in some embodiments can be configured to optimize thelayer 4 processing of the data message flows passing through thenetwork. For instance, in some embodiments, the virtual networkoptimizes the end-to-end rate of TCP (Transport Control Protocol)connections by splitting the rate control mechanisms across theconnection path.

Some embodiments establish the virtual network by configuring severalcomponents that are deployed in several public clouds. These componentsinclude in some embodiments software-based measurement agents, softwareforwarding elements (e.g., software routers, switches, gateways, etc.),layer-4 connection proxies and middlebox service machines (e.g.,appliances, VMs, containers, etc.).

Some embodiments utilize a logically centralized controller cluster(e.g., a set of one or more controller servers) that configures thepublic-cloud components to implement the virtual network over severalpublic clouds. In some embodiments, the controllers in this cluster areat various different locations (e.g., are in different public clouddatacenters) in order to improve redundancy and high availability. Whendifferent controllers in the controller cluster are located in differentpublic cloud datacenters, the controllers in some embodiments sharetheir state (e.g., the configuration data that they generate to identifytenants, routes through the virtual networks, etc.). The controllercluster in some embodiments scales up or down the number of public cloudcomponents that are used to establish the virtual network, or thecompute or network resources allocated to these components.

Some embodiments establish different virtual networks for differententities over the same set of public clouds of the same public cloudproviders and/or over different sets of public clouds of the same ordifferent public cloud providers. In some embodiments, a virtual networkprovider provides software and services that allow different tenants todefine different virtual networks over the same or different publicclouds. In some embodiments, the same controller cluster or differentcontroller clusters can be used to configure the public cloud componentsto implement different virtual networks over the same or different setsof public clouds for several different entities.

Several examples of corporate virtual networks are provided in thediscussion below. However, one of ordinary skill will realize that someembodiments define virtual networks for other types of entities, such asother business entities, non-profit organizations, educational entities,etc. Also, as used in this document, data messages refer to a collectionof bits in a particular format sent across a network. One of ordinaryskill in the art will recognize that the term data message is used inthis document to refer to various formatted collections of bits that aresent across a network. The formatting of these bits can be specified bystandardized protocols or non-standardized protocols. Examples of datamessages following standardized protocols include Ethernet frames, IPpackets, TCP segments, UDP datagrams, etc. Also, as used in thisdocument, references to L2, L3, L4, and L7 layers (or layer 2, layer 3,layer 4, and layer 7) are references respectively to the second datalink layer, the third network layer, the fourth transport layer, and theseventh application layer of the OSI (Open System Interconnection) layermodel.

FIG. 1A presents a virtual network 100 that is defined for a corporationover several public cloud datacenters 105 and 110 of two public cloudproviders A and B. As shown, the virtual network 100 is a secure overlaynetwork that is established by deploying different managed forwardingnodes 150 in different public clouds and connecting the managedforwarding nodes (MFNs) to each other through overlay tunnels 152. Insome embodiments, an MFN is a conceptual grouping of several differentcomponents in a public cloud datacenter that with other MFNs (with othergroups of components) in other public cloud datacenters establish one ormore overlay virtual networks for one or more entities.

As further described below, the group of components that form an MFNinclude in some embodiments (1) one or more VPN gateways forestablishing VPN connections with an entity's compute nodes (e.g.,offices, private datacenters, remote users, etc.) that are externalmachine locations outside of the public cloud datacenters, (2) one ormore forwarding elements for forwarding encapsulated data messagesbetween each other in order to define an overlay virtual network overthe shared public cloud network fabric, (3) one or more service machinesfor performing middlebox service operations as well as L4-L7optimizations, and (4) one or more measurement agents for obtainingmeasurements regarding the network connection quality between the publiccloud datacenters in order to identify desired paths through the publiccloud datacenters. In some embodiments, different MFNs can havedifferent arrangements and different numbers of such components, and oneMFN can have different numbers of such components for redundancy andscalability reasons.

Also, in some embodiments, each MFN's group of components execute ondifferent computers in the MFN's public cloud datacenter. In someembodiments, several or all of an MFN's components can execute on onecomputer of a public cloud datacenter. The components of an MFN in someembodiments execute on host computers that also execute other machinesof other tenants. These other machines can be other machines of otherMFNs of other tenants, or they can be unrelated machines of othertenants (e.g., compute VMs or containers).

The virtual network 100 in some embodiments is deployed by a virtualnetwork provider (VNP) that deploys different virtual networks over thesame or different public cloud datacenters for different entities (e.g.,different corporate customers/tenants of the virtual network provider).The virtual network provider in some embodiments is the entity thatdeploys the MFNs and provides the controller cluster for configuring andmanaging these MFNs.

The virtual network 100 connects the corporate compute endpoints (suchas datacenters, branch offices and mobile users) to each other and toexternal services (e.g., public web services, or SaaS services such asOffice365 or Salesforce) that reside in the public cloud or reside inprivate datacenter accessible through the Internet. As further describedbelow, SaaS in some embodiments is a software distribution model inwhich a third-party provider hosts applications and makes them availableto customers over the Internet.

The virtual network 100 leverages the different locations of thedifferent public clouds to connect different corporate compute endpoints(e.g., different private networks and/or different mobile users of thecorporation) to the public clouds in their vicinity. Corporate computeendpoints are also referred to as corporate compute nodes in thediscussion below. In some embodiments, the virtual network 100 alsoleverages the high-speed networks that interconnect these public cloudsto forward data messages through the public clouds to their destinationsor to get as close to their destinations while reducing their traversalthrough the Internet. When the corporate compute endpoints are outsideof public cloud datacenters over which the virtual network spans, theseendpoints are referred to as external machine locations. This is thecase for corporate branch offices, private datacenters and devices ofremote users.

In the example illustrated in FIG. 1A, the virtual network 100 spans sixdatacenters 105 a-105 f of the public cloud provider A and fourdatacenters 110 a-110 d of the public cloud provider B. In spanningthese public clouds, this virtual network connects several branchoffices, corporate datacenters, SaaS providers and mobile users of thecorporate tenant that are located in different geographic regions.Specifically, the virtual network 100 connects two branch offices 130 aand 130 b in two different cities (e.g., San Francisco, California, andPune, India), a corporate datacenter 134 in another city (e.g., Seattle,Washington), two SaaS provider datacenters 136 a and 136 b in anothertwo cities (Redmond, Washington, and Paris, France), and mobile users140 at various locations in the world. As such, this virtual network canbe viewed as a virtual corporate WAN.

In some embodiments, the branch offices 130 a and 130 b have their ownprivate networks (e.g., local area networks) that connect computers atthe branch locations and branch private datacenters that are outside ofpublic clouds. Similarly, the corporate datacenter 134 in someembodiments has its own private network and resides outside of anypublic cloud datacenter. In other embodiments, however, the corporatedatacenter 134 or the datacenter of the branch 130 a and 130 b can bewithin a public cloud, but the virtual network does not span this publiccloud, as the corporate or branch datacenter connects to the edge of thevirtual network 100.

As mentioned above, the virtual network 100 is established by connectingdifferent deployed managed forwarding nodes 150 in different publicclouds through overlay tunnels 152. Each managed forwarding node 150includes several configurable components. As further described above andfurther described below, the MFN components include in some embodimentssoftware-based measurement agents, software forwarding elements (e.g.,software routers, switches, gateways, etc.), layer 4 proxies (e.g., TCPproxies) and middlebox service machines (e.g., VMs, containers, etc.).One or more of these components in some embodiments use standardized orcommonly available solutions, such as Open vSwitch, OpenVPN, strongSwan,etc.

In some embodiments, each MFN (i.e., the group of components theconceptually forms an MFN) can be shared by different tenants of thevirtual network provider that deploys and configures the MFNs in thepublic cloud datacenters. Conjunctively, or alternatively, the virtualnetwork provider in some embodiments can deploy a unique set of MFNs inone or more public cloud datacenters for a particular tenant. Forinstance, a particular tenant might not wish to share MFN resources withanother tenant for security reasons or quality of service reasons. Forsuch a tenant, the virtual network provider can deploy its own set ofMFNs across several public cloud datacenters.

In some embodiments, a logically centralized controller cluster 160(e.g., a set of one or more controller servers) operate inside oroutside of one or more of the public clouds 105 and 110, and configurethe public-cloud components of the managed forwarding nodes 150 toimplement the virtual network over the public clouds 105 and 110. Insome embodiments, the controllers in this cluster are at variousdifferent locations (e.g., are in different public cloud datacenters) inorder to improve redundancy and high availability. The controllercluster in some embodiments scales up or down the number of public cloudcomponents that are used to establish the virtual network, or thecompute or network resources allocated to these components.

In some embodiments, the controller cluster 160, or another controllercluster of the virtual network provider, establishes a different virtualnetwork for another corporate tenant over the same public clouds 105 and110, and/or over different public clouds of different public cloudproviders. In addition to the controller cluster(s), the virtual networkprovider in other embodiments deploys forwarding elements and servicemachines in the public clouds that allow different tenants to deploydifferent virtual networks over the same or different public clouds.FIG. 1B illustrates an example of two virtual networks 100 and 180 fortwo corporate tenants that are deployed over the public clouds 105 and110. FIG. 1C alternatively illustrates an example of two virtualnetworks 100 and 182, with one network 100 deployed over public clouds105 and 110 and the other virtual network 182 deployed over another pairof public clouds 110 and 115.

Through the configured components of the MFNs, the virtual network 100of FIG. 1A allows different private networks and/or different mobileusers of the corporate tenant to connect to different public clouds thatare in optimal locations (e.g., as measured in terms of physicaldistance, in terms of connection speed, loss, delay and/or cost, and/orin terms of network connection reliability, etc.) with respect to theseprivate networks and/or mobile users. These components also allow thevirtual network 100 in some embodiments to use the high-speed networksthat interconnect the public clouds to forward data messages through thepublic clouds to their destinations while reducing their traversalthrough the Internet.

In some embodiments, the MFN components are also configured to run novelprocesses at the network, transport and application layers to optimizethe end-to-end performance, reliability and security. In someembodiments, one or more of these processes implement proprietaryhigh-performance networking protocols, free from the current networkprotocol ossification. As such, the virtual network 100 in someembodiments is not confined by Internet autonomous systems, routingprotocols, or even end-to-end transport mechanisms.

For example, in some embodiments, the components of the MFNs 150 (1)create optimized, multi-path and adaptive centralized routing, (2)provide strong QoS (Quality of Service) guarantees, (3) optimizeend-to-end TCP rates through intermediate TCP splitting and/ortermination, and (4) relocate scalable application-level middleboxservices (e.g., firewalls, intrusion detection systems (IDS), intrusionprevention system (IPS), WAN optimization, etc.) to the compute part ofthe cloud in a global network function virtualization (NFV).Accordingly, the virtual network can be optimized to fit customized andchanging demands of the corporation without being bound to existingnetwork protocol. Also, in some embodiments, the virtual network can beconfigured as a “pay as you go” infrastructure that can be dynamicallyand elastically scaled up and down both in performance capability and ingeographical span according to the continuous requirement changes.

To implement the virtual network 100, at least one managed forwardingnode 150 in each public cloud datacenter 105 a-105 f and 110 a-110 dspanned by the virtual network has to be configured by the set ofcontrollers. FIG. 2 illustrates an example of a managed forwarding node150 and a controller cluster 160 of some embodiments of the invention.In some embodiments, each managed forwarding node 150 is a machine(e.g., a VM or container) that executes on a host computer in a publiccloud datacenter. In other embodiments, each managed forwarding node 150is implemented by multiple machines (e.g., multiple VMs or containers)that execute on the same host computer in one public cloud datacenter.In still other embodiments, two or more components of one MFN can beimplemented by two or more machines executing on two or more hostcomputers in one or more public cloud datacenters.

As shown, the managed forwarding node 150 includes a measurement agent205, firewall and NAT middlebox service engines 210 and 215, one or moreoptimization engines 220, edge gateways 225 and 230, and a cloudforwarding element 235 (e.g., a cloud router). In some embodiments, eachof these components 205-235 can be implemented as a cluster of two ormore components.

The controller cluster 160 in some embodiments can dynamically scale upor down each component cluster (1) to add or remove machines (e.g., VMsor containers) to implement each component's functionality and/or (2) toadd or remove compute and/or network resources to the previouslydeployed machines that implement that cluster's components. As such,each deployed MFN 150 in a public cloud datacenter can be viewed as acluster of MFNs, or it can be viewed as a node that includes multipledifferent component clusters that perform different operations of theMFN.

Also, in some embodiments, the controller cluster deploys different setsof MFNs in the public cloud datacenters for different tenants for whichthe controller cluster defines virtual networks over the public clouddatacenters. In this approach, the virtual networks of any two tenantsdo not share any MFN. However, in the embodiments described below, eachMFN can be used to implement different virtual networks for differenttenants. One of ordinary skill will realize that in other embodimentsthe controller cluster 160 can implement the virtual network of eachtenant of a first set of tenants with its own dedicated set of deployedMFNs, while implementing the virtual network of each tenant of a secondset of tenants with a shared set of deployed MFNs.

In some embodiments, the branch gateway 225 and remote device gateway230 establish secure VPN connections respectively with one or morebranch offices 130 and remote devices (e.g., mobile devices 140) thatconnect to the MFN 150, as shown in FIG. 2 . One example of such VPNconnections are IPsec connections, which will be further describedbelow. However, one of ordinary skill will realize that in otherembodiments, such gateways 225 and/or 230 establish different types ofVPN connections.

An MFN 150 in some embodiments includes one or more middlebox enginesthat perform one or more middlebox service operations, such are firewalloperations, NAT operations, IPS operations, IDS operations, loadbalancing operations, WAN optimization operations, etc. By incorporatingthese middlebox operations (e.g., firewall operations, WAN optimizationoperations, etc.) in the MFNs that are deployed in the public cloud, thevirtual network 100 implements in the public cloud much of the functionsthat are traditionally performed by the corporate WAN infrastructure ata corporation's datacenter(s) and/or branch office(s).

Accordingly, for many of the middlebox services, the corporate computenodes (e.g., remote devices, branch offices and datacenters) no longerhave to access the corporate WAN infrastructure of the corporation in aprivate datacenter or branch office, as much of these services are nowdeployed in the public clouds. This approach speeds up the access of thecorporate compute nodes (e.g., remote devices, branch offices anddatacenters) to these services, and avoids costly congested-networkbottlenecks at private datacenters that would otherwise be dedicated tooffering such services.

This approach effectively distributes the WAN gateway functionality tovarious MFNs in the public cloud datacenters. For instance, in thevirtual network 100 of some embodiments, most or all of the traditionalcorporate WAN gateway security functions (e.g., firewall operations,intrusion detection operations, intrusion prevention operations, etc.)are moved to the public cloud MFNs (e.g., ingress MFNs at which datafrom compute endpoints is received into the virtual network). Thiseffectively allows the virtual network 100 to have a distributed WANgateway that is implemented at many different MFNs that implement thevirtual network 100.

In the example illustrated in FIG. 2 , the MFN 150 is shown to includethe firewall engine 210, the NAT engine 215 and one or more L4-L7optimization engines. One of ordinary skill will realize that in otherembodiments, the MFN 150 includes other middlebox engines for performingother middlebox operations. In some embodiments, the firewall engine 210enforces firewall rules on (1) data message flows on their ingress pathsinto the virtual network (e.g., on data message flows that the gateways225 and 230 receives and process from branch offices 130 and mobiledevices 140) and (2) data messages flows on their egress paths out ofthe virtual network (e.g., on data message flows that are sent to SaaSprovider datacenters through the NAT engine 215 and the Internet 202).

The firewall engine 210 of the MFN 150 in some embodiments also enforcesfirewall rules when the firewall engine belongs to an MFN that is anintermediate hop between an ingress MFN at which a data message flowenters a virtual network and an egress MFN at which the data messageflow exits the virtual network. In other embodiments, the firewallengine 210 only enforces firewall rules when it is part of a datamessage flow's ingress MFN and/or egress MFN.

In some embodiments, the NAT engine 215 performs a network addresstranslation to change the source network addresses of data message flowson their egress paths out of the virtual network to third party devices(e.g., to SaaS provider machines) through the Internet 202. Such networkaddress translations ensure that third-party machines (e.g., SaaSmachines) can be properly configured to process the data message flowsthat without the address translations might specify private networkaddresses of the tenants and/or the public cloud providers. This isparticularly problematic as private network addresses of differenttenants and/or cloud providers might overlap. The address translationalso ensures that the reply messages from the third party devices (e.g.,the SaaS machines) can be properly received by the virtual network(e.g., by the MFN NAT engine from which the message exited the virtualnetwork).

The NAT engines 215 of the MFNs in some embodiments perform double-NAToperations on each data message flow that leaves the virtual network toreach a third party machine, or that enters the virtual network from athird party machine. As further described below, one NAT operation inthe two NAT operations is performed on such a data message flow at itsingress MFN when it enters the virtual network, while the other NAToperation is performed on the data message flow at its egress MFN whenit exits the virtual network.

This double NAT approach allows more tenant private networks to bemapped to the networks of the public cloud providers. This approach alsoreduces the load for distributing to the MFNs data regarding changes totenant private networks. Before the ingress or egress NAT operations,some embodiments perform a tenant mapping operation that uses the tenantidentifier to first map the tenant's source network address to anothersource network address that is then mapped to yet another source networkaddress by the NAT operation. Performing the double NAT operationreduces the data distribution load for distributing data regardingchanges to the tenant private networks.

The optimization engine 220 executes novel processes that optimize theforwarding of the entity's data messages to their destinations for bestend-to-end performance and reliability. Some of these processesimplement proprietary high-performance networking protocols, free fromthe current network protocol ossification. For example, in someembodiments, the optimization engine 220 optimizes end-to-end TCP ratesthrough intermediate TCP splitting and/or termination.

The cloud forwarding element 235 is the MFN engine that is responsiblefor forwarding a data message flow to the next hop MFN's cloudforwarding element (CFE) when the data message flow has to traverse toanother public cloud to reach its destination, or to an egress router inthe same public cloud when the data message flow can reach itsdestination through the same public cloud. In some embodiments, the CFE235 of the MFN 150 is a software router.

To forward the data messages, the CFE encapsulates the messages withtunnel headers. Different embodiments use different approaches toencapsulate the data messages with tunnel headers. Some embodimentsdescribed below use one tunnel header to identify network ingress/egressaddresses for entering and exiting the virtual network, and use anothertunnel header to identify next hop MFNs when a data message has totraverse one or more intermediate MFN to reach the egress MFN.

Specifically, in some embodiments, the CFE sends the data message withtwo tunnel headers (1) an inner header that identifies an ingress CFEand egress CFE for entering and exiting the virtual network, and (2) anouter header that identifies the next hop CFE. The inner tunnel headerin some embodiments also includes a tenant identifier (TID) in order toallow multiple different tenants of the virtual network provider to usea common set of MFN CFEs of the virtual network provider. Otherembodiments define tunnel headers differently in order to define theoverlay virtual network.

To deploy a virtual network for a tenant over one or more public clouds,the controller cluster (1) identifies possible ingress and egressrouters for entering and exiting the virtual network for the tenantbased on locations of the tenant's corporate compute nodes (e.g., branchoffices, datacenters, mobile users and SaaS providers), and (2)identifies routes that traverse from the identified ingress routers tothe identified egress routers through other intermediate public-cloudrouters that implement the virtual network. After identifying theseroutes, the controller cluster propagates these routes to the forwardingtables of the MFN CFEs 235 in the public cloud(s). In the embodimentsthat use OVS-based virtual network routers, the controller distributesthe routes by using OpenFlow.

In some embodiments, the controller cluster 160 can also configure thecomponents 205-235 of each MFN 150 that implements the virtual networkto optimize several network processing layers in order to achieve bestend-to-end performance, reliability and security. For example, in someembodiments, these components are configured (1) to optimize layer 3traffic routing (e.g., shortest path, packet duplication), (2) tooptimize layer 4 TCP congestion control (e.g., segmentation, ratecontrol), (3) to implement security features (e.g., encryption, deeppacket inspection, firewall), and (4) to implement application-layercompression features (e.g., de-duplication, caching). Within the virtualnetwork, corporate traffic is secured, inspected and logged.

In some embodiments, one measurement agent is deployed for each MFN in apublic cloud datacenter. In other embodiments, multiple MFNs in a publiccloud datacenter or in a collection of datacenters (e.g., in acollection of nearby, associated datacenters, such as datacenters in oneavailability zone) share one measurement agent. To optimize the layers 3and 4 processing, the measurement agent 205 associated with each managedforwarding node 150 repeatedly generates measurement values thatquantify the quality of the network connection between its node and eachof several other “neighboring” nodes.

Different embodiments define neighboring nodes differently. For aparticular MFN in one public cloud datacenter of a particular publiccloud provider, a neighboring node in some embodiments includes (1) anyother MFN that operates in any public cloud datacenter of the particularpublic cloud provider, and (2) any other MFN that operates in anotherpublic cloud provider's datacenter that is within the same “region” asthe particular MFN.

Different embodiments define the same region differently. For instance,some embodiments define a region in terms of a distance that specifies abounding shape around the particular managed forwarding node. Otherembodiments define regions in terms of cities, states, or regionalareas, such as northern California, southern California, etc. Theassumption of this approach is that different datacenters of the samepublic cloud provider are connected with very high-speed networkconnections, while the network connections between the datacenters ofdifferent public cloud providers are likely fast when the datacentersare within the same region but likely not as fast when the datacentersare in different regions. The connection between the datacenters ofdifferent public cloud providers might have to traverse long distancesthrough the public Internet when the datacenters are in differentregions.

The measurement agent 205 generates measurement values differently indifferent embodiments. In some embodiments, the measurement agent sendspinging messages (e.g., UDP echo messages) periodically (e.g., onceevery second, every N seconds, every minute, every M minutes, etc.) toeach of the measurement agents of its neighboring managed forwardingnodes. Given the small size of the pinging messages, they do not resultin large network connection charges. For instance, for 100 nodes witheach node sending a ping to each other node every 10 seconds, about 10Kb/s of ingress and egress measurement traffic is generated for eachnode, and this leads to network consumption charges of a few dollars(e.g., $5) per node per year, given the current public cloud prices.

Based on the speed of the reply messages that it receives, themeasurement agent 205 computes and updates measurement metric values,such as network-connection throughput speed, delay, loss, and linkreliability. By repeatedly doing these operations, the measurement agent205 defines and updates a matrix of measurement results that expressesthe quality of network connections to its neighboring nodes. As theagent 205 interacts with the measurement agents of its neighboringnodes, its measurement matrix only quantifies the quality of theconnections to its local clique of nodes.

The measurement agents of the different managed forwarding nodes sendtheir measurement matrices to the controller cluster 160, which thenaggregates all different clique connection data to obtain an aggregatemesh view of the connections between different pairs of managedforwarding nodes. When the controller cluster 160 collects differentmeasurements for a link between two pairs of forwarding nodes (e.g.,measurements taken by one node at different times), the controllercluster produces a blended value from the different measurements (e.g.,produces an average or a weighted average of the measurements). Theaggregate mesh view in some embodiments is a full mesh view of all thenetwork connections between each pair of managed forwarding nodes, whilein other embodiments it is a more complete view than the one produced bythe measurement agents of the individual managed forwarding nodes.

As shown in FIG. 2 , the controller cluster 160 includes a cluster ofone or more measurement-processing engines 280, one or morepath-identifying engines 282, and one or more management interfaces 284.In order not to obscure the description with unnecessary detail, each ofthese clusters will be referred to below in terms of singular engine orinterface layers, i.e., in terms of a measurement-processing layer 280,a path-identifying layer 282, and a management interface layer 284.

The measurement-processing layer 280 receives the measurement matricesfrom the measurement agents 205 of the managed forwarding nodes andprocesses these measurements matrices to produce the aggregate meshmatrix that expresses the connection quality between different pairs ofmanaged forwarding nodes. The measurement-processing layer 280 providesthe aggregate mesh matrix to the path-identifying layer 282. Based onthe aggregate mesh matrix, the path-identifying layer 282 identifiesdifferent desired routing paths through the virtual network forconnecting different corporate data endpoints (e.g., different branchoffices, corporate datacenters, SaaS provider datacenters and/or remotedevices). This layer 282 then provides these routing paths in routetables that are distributed to the cloud forwarding elements 235 of themanaged forwarding nodes 150.

In some embodiments, the identified routing path for each pair of datamessage endpoints is a routing path that is deemed optimal based on aset of optimization criteria, e.g., it is the fastest routing path, theshortest routing path, or the path that least uses the Internet. Inother embodiments, the path-identifying engine can identify and provide(in the routing table) multiple different routing paths between the sametwo endpoints. In these embodiments, the cloud forwarding elements 235of the managed forwarding nodes 150 then select one of the paths basedon QoS criteria or other runtime criteria that they are enforcing. EachCFE 235 in some embodiments does not receive the entire routing pathfrom the CFE to the egress point of the virtual network, but ratherreceives the next hop for the path.

In some embodiments, the path-identifying layer 282 uses the measurementvalues in the aggregate mesh matrix as inputs to routing algorithms thatit executes to construct a global routing graph. This global routinggraph is an aggregated and optimized version of a measurement graph thatthe measurement-processing layer 280 produces in some embodiments. FIG.3 illustrates an example of a measurement graph 300 that the controllermeasurement-processing layer 280 produces in some embodiments. Thisgraph depicts network connections between various managed forwardingnodes 150 in AWS and GCP public clouds 310 and 320 (i.e., in thedatacenters of AWS and GCP). FIG. 4A illustrates an example of a routinggraph 400 that the controller path-identifying layer 282 produces insome embodiments from the measurement graph 300.

FIG. 5 illustrates a process 500 that the controller path-identifyinglayer uses to generate a routing graph from a measurement graph receivedfrom the controller measurement layer. The path-identifying layer 282performs this process 500 repeatedly as it repeatedly receives updatedmeasurement graphs from the controller measurement layer (e.g., performsthe process 500 each time that it receives a new measurement graph, oreach N^(th) time that it receives a new measurement graph). In otherembodiments, the path-identifying layer 282 performs this processperiodically (e.g., once every 12 hours or 24 hours).

As shown, the path-identifying layer initially defines (at 505) therouting graph to be identical to the measurement graph (i.e., to havethe same links between the same pairs of managed forwarding nodes). At510, the process removes bad links from the measurement graph 300.Examples of bad links are links with excessive message loss or poorreliability (e.g., links with greater than 2% message loss in last 15minutes, or with message loss greater than 10% in the last 2 minute).FIG. 4A illustrates that links 302, 304 and 306 in the measurement graph300 are excluded in the routing graph 400. This figure illustrates theexclusion of these links by depicting these links with dashed lines.

Next, at 515, the process 500 computes a link weight score (cost score)as a weighted combination of several computed and provider-specificvalues. In some embodiments, the weight score is a weighted combinationof the link's (1) computed delay value, (2) computed loss value, (3)provider network-connection cost, and (4) provider compute cost. In someembodiments, the provider compute cost is accounted for as the managedforwarding nodes connected by the link are machines (e.g., VMs orcontainers) that execute on host computers in the public clouddatacenter(s).

At 520, the process adds to the routing graph the known source anddestination IP addresses (e.g., known IPs of SaaS providers used by thecorporate entity) for the data message flows in the virtual network. Insome embodiments, the process adds each known IP address of a possiblemessage-flow endpoint to the node (e.g., to the node representing anMFN) in the routing graph that is closest to that end point. In doingso, the process in some embodiments assumes that each such endpoint isconnected to the virtual network through a link with a zero delay costand a zero loss cost. FIG. 4B illustrates an example of adding known IPsfor two SaaS providers to the two nodes 402 and 404 (representing twoMFNs) in the routing graph that are in datacenters that are closest tothe datacenters of these SaaS providers. In this example, one node is inan AWS public cloud, while the other node is in the GCP public cloud.

Alternatively, or conjunctively, the process 500 in some embodimentsadds the known source and destination IP addresses to the routing graphby adding nodes to this graph to represent the source and destinationendpoints, assigning IP addresses to these nodes, and assigning weightvalues to the links that connect these added nodes to other nodes in therouting graph (e.g., to nodes in the routing graph that represent MFNsin the public clouds). When the source and destination endpoints for theflows are added as nodes, the path-identifying engine 282 can accountfor cost (e.g., distance cost, delay cost, and/or financial cost, etc.)of reaching these nodes when it is identifying different routes throughthe virtual network between different source and destination endpoints.

FIG. 4C illustrates a routing graph 410 that is generated by adding twonodes 412 and 414 to the node graph 400 of FIG. 4A in order to representtwo SaaS providers. In this example, the known IP addresses are assignedto nodes 412 and 414, and these nodes are connected to nodes 402 and 404(representing two MFNs) through links 416 and 418 that have weights W1and W2 assigned to them. This approach is an alternative approach foradding the known IP addresses of the two SaaS providers to the approachillustrated in FIG. 4B.

FIG. 4D illustrates a more detailed routing graph 415. In this moredetailed routing graph, additional nodes 422 and 424 are added torepresent external corporate compute nodes (e.g., branch offices anddatacenters) with known IP addresses that connect respectively to theAWS and GCP public clouds 310 and 320. Each of these nodes 422/424 isconnected by at least one link 426 with an associated weight value Wi toat least one of the routing graph nodes that represents an MFN. Some ofthese nodes (e.g., some of the branch offices) are connected withmultiple links to same MFN or to different MFNs.

Next, at 525, the process 500 compute the lowest cost paths (e.g.,shortest paths, etc.) between each MFN and each other MFN that can serveas a virtual network egress location for a data message flow of thecorporate entity. The egress MFNs in some embodiments include the MFNsconnected to external corporate compute nodes (e.g., branch offices,corporate datacenters, and SaaS provider datacenters) as well as MFNsthat are candidate locations for mobile device connections and egressInternet connections. In some embodiments, this computation uses atraditional lowest-cost (e.g., shortest-path) identification processthat identifies the shortest paths between different MFN pairs.

For each candidate MFN pair, the lowest-cost identification process usesthe computed weight scores (i.e., the scores computed at 510) toidentify a path with the lowest score when multiple such paths existbetween the MFN pair. Several manners for computing lowest-cost pathswill be further described below. As mentioned above, thepath-identifying layer 282 identifies multiples paths between two MFNpairs in some embodiments. This is to allow the cloud forwardingelements 235 to use different paths under different circumstances.Accordingly, in these embodiments, the process 500 can identify multiplepaths between two MFN pairs.

At 530, the process removes from the routing graph the links between MFNpairs that are not used by any of the lowest-cost paths identified at525. Next, at 535, the process generates the routing tables for thecloud forwarding elements 235 from the routing graph. At 535, theprocess distributes these routing tables to the cloud forwardingelements 235 of the managed forwarding nodes. After 535, the processends.

In some embodiments, the virtual network has two types of externalconnections, which are: (1) external secure connections with the computenodes (e.g., branch offices, datacenters, mobile users, etc.) of anentity, and (2) external connections to third party computers (e.g.,SaaS provider servers) through the Internet. Some embodiments optimizethe virtual network by finding optimal virtual-network ingress andegress locations for each datapath that terminates at source anddestination nodes outside of the virtual network. For instance, toconnect a branch office to a SaaS provider server (e.g., salesforce.comserver), some embodiments connect the branch office to an optimal edgeMFN (e.g., the MFN that has the fastest network connection to the branchoffice or the one that is closest to the branch office), and identify anoptimal edge MFN to an optimally located SaaS provider server (e.g., theSaaS that is closest to the edge MFN for the branch office or has thefastest path to the edge MFN for the branch office through the edge MFNconnected to the SaaS provider server).

To associate each compute node (e.g., a branch office, a mobile user,etc.) of an entity to the closest MFN through a VPN connection, thevirtual network provider in some embodiments deploys one or moreauthoritative domain name servers (DNS) in the public clouds for thecompute nodes to contact. In some embodiments, each time a corporatecompute node in some embodiments needs to establish a VPN connection(i.e., to initialize or re-initialize the VPN connection) to an MFN ofthe virtual network provider, the compute node first resolves an addressassociated with its virtual network (e.g., virtualnetworkX.net) withthis authoritative DNS server in order to obtain from this server theidentity of the MFN that this server identifies as the MFN that isclosest to the corporate compute node. To identify this MFN, theauthoritative DNS server provides an MFN identifier (e.g., the IPaddress of the MFN) in some embodiments. The corporate compute node thenestablishes a VPN connection to this managed forwarding node.

In other embodiments, the corporate compute node does not first performa DNS resolution (i.e., does not first resolve a network address for aparticular domain) each time that it needs to establish a VPN connectionto an MFN of the VNP. For instance, in some embodiments, the corporatecompute node sticks with a DNS-resolved MFN for a particular duration(e.g., for a day, a week, etc.) before performing another DNS resolutionto determine whether this MFN is still an optimal one to which is shouldconnect.

When the source IP address in the DNS request is that of the local DNSserver of the corporate compute node, and not of the node itself, theauthoritative DNS server in some embodiments identifies the MFN closestto the local DNS server instead of the MFN closest to the corporatecompute node. To address this, the DNS request in some embodimentsidentifies the corporate compute node in terms of a domain name thatincludes one or more parts (labels) that are concatenated and delimitedby dots, where one of these parts identifies the corporation and theother part identifies the compute node of the corporation.

In some embodiments, this domain name specifies a hierarchy of domainsand sub-domains that descends from the right label to the left label inthe domain name. The right-most first label identifies the particulardomain, a second label to the left of the first label identifies thecorporate entity, and a third label to the left of the second labelidentifies the external machine location of the entity in cases wherethe entity has more than one external machine location. For instance, insome embodiments, the DNS request identifies the corporate compute nodeas myNode of company myCompany, and asks for the resolution of theaddress myNode.myCompany.virtualnetwork.net. The DNS server then usesthe myNode identifier to better select the ingress MFN to which thecorporate compute node should establish a VPN connection. In differentembodiments, the myNode identifier is expressed differently. Forexample, it may be addressed as an IP address, a latitude/longitudedescription of a location, a GPS (Global Positioning System) location, astreet address, etc.

Even when the IP address properly reflects the location, there may beseveral potential ingress routers, e.g., belonging to differentdatacenters in the same cloud or to different clouds in the same region.In such a case, the virtual network authoritative server in someembodiments sends back a list of IPs of potential MFN CFEs (e.g., C5,C8, C12). The corporate compute node in some embodiments then pings thedifferent CFEs in the list, to produce measurements (e.g., distance orspeed measurements), and selects the closest one by comparingmeasurements among the set of CFE candidates.

In addition, the corporate compute node may base this selection byidentifying the MFNs currently used by the other compute nodes of thecorporate entity. For example, in some embodiments, the corporatecompute node adds connection costs to each MFN, so that if many of thecorporate branches are already connected to a given cloud, new computenodes would have an incentive to connect to the same cloud, thusminimizing inter-cloud costs in terms of processing, latency, anddollars.

Other embodiments use other DNS resolution techniques. For instance,each time a corporate compute node (e.g., a branch office, datacenter, amobile user, etc.) needs to perform a DNS resolution, the corporatecompute node (e.g., the mobile device or a local DNS resolver at abranch office or datacenter) communicates with a DNS service providerthat serves as an authoritative DNS resolver for a number of entities.In some embodiments, this DNS service provider has DNS resolvingmachines located in one or more private datacenters, while in otherembodiments it is part of one or more public cloud datacenters.

To identify which of N managed forwarding nodes that connect directly tothe Internet should be used to reach a SaaS provider server, the virtualnetwork (e.g., the ingress MFN or the controller cluster that configuresthe MFNs) in some embodiments identifies a set of one or more candidateedge MFNs from the N managed forwarding nodes. As described furtherbelow, each candidate edge MFN in some embodiments is an edge MFN thatis deemed to be optimal based on a set of criteria, such as distance toSaaS provider server, network connection speed, cost, delay and/or loss,network compute cost, etc.

To assist in identifying the optimal edge points, the controller clusterof some embodiments maintains for an entity a list of the most popularSaaS providers and consumer web destinations and their IP addresssubnets. For each such destination, the controller cluster assigns oneor more of the optimal MFNs (again as judged by physical distance,network connection speed, cost, loss and/or delay, compute cost, etc.)as candidate egress nodes. For each candidate egress MFN, the controllercluster then computes the best route from each possible ingress MFN tothe candidate MFN, and sets up the resulting next-hop table in the MFNsaccordingly, such that the Internet SaaS provider or web destination isassociated to the correct virtual network next-hop node.

Given that the service destination can often be reached through severalIP subnets at several locations (as provided by the authoritative DNSserver), there are several potential egress nodes to minimize latencyand provide load-balancing. Accordingly, in some embodiments, thecontroller cluster computes the best location and egress node for eachMFN, and updates the next-hop accordingly. Also, the best egress node toget to a SaaS provider (e.g., office365.com) may be through one publiccloud provider (e.g., Microsoft Azure), but the best ingress MFN frompurely a distance or connection speed may be in another public cloudprovider (e.g., AWS). In such situations, it may not be optimal in termsof latency, processing and cost to traverse to another cloud (i.e., tothe public cloud with the best egress MFN) before leaving the virtualnetwork. Providing multiple candidate edge nodes would allow for theselection of an optimal edge MFN and an optimal path to the selectededge MFN in such situations.

To identify the optimal path through the virtual network to an egressMFN that connects to the Internet or connects to a corporate computenode of the corporate entity, the controller cluster identifies optimalrouting paths between the MFNs. As mentioned above, the controllercluster in some embodiments identifies the best path between any twoMFNs by first costing each link between a pair of directly connectedMFNs, e.g., based on a metric score that reflects the weighted sum ofestimated latency and financial costs. The latency and financial costsinclude in some embodiments (1) link delay measurements, (2) estimatedmessage processing latency, (3) cloud charges for outgoing traffic froma particular datacenter either to another datacenter of the same publiccloud provider, or to exit the public cloud (PC) provider's cloud (e.g.,to another public cloud datacenter of another public cloud provider orto the Internet), and (4) estimated message processing costs associatedwith the MFNs executing on host computers in the public clouds.

Using the computed costs of these pair-wise links, the controllercluster can compute the cost of each routing path that uses one or moreof these pair-wise links by aggregating the costs of the individualpair-wise links that are used by the routing path. As described above,the controller cluster then defines its routing graph based on thecomputed costs of the routing paths, and generates the forwarding tablesof the cloud routers of the MFNs based on the defined routing graphs.Also, as mentioned above, the controller cluster repeatedly performsthese costing, graph-building, and forwarding table update anddistribution operations periodically (e.g., once every 12 hours, 24hours, etc.) or as it receives measurement updates from the measurementagents of the MFNs.

Whenever the forwarding table at an MFN CFE C₁ points to a next-hop MFNCFE the CFE C₁ considers C₁ as a neighbor. In some embodiments, the CFEC₁ establishes a secure, actively maintained VPN tunnel to CFE C₁. Asecure tunnel in some embodiments is a tunnel that requires the payloadsof the encapsulated data messages to be encrypted. Also, in someembodiments, a tunnel is actively maintained by one or both endpoints ofthe tunnel sending keep alive signals to the other endpoint.

In other embodiments, the CFEs do not establish secure, activelymaintained VPN tunnels. For instance, in some embodiments, the tunnelsbetween the CFEs are static tunnels that are not actively monitoredthrough the transmission of keep-alive signals. Also, in someembodiments, these tunnels between the CFEs do not encrypt theirpayloads. In some embodiments, the tunnels between pair of CFEs includetwo encapsulating headers, with the inner header identifying the tenantID and the ingress and egress CFEs for a data message entering andexiting the virtual network (i.e., entering and exiting the publiccloud(s)), and the outer encapsulating header specifying the source anddestination network addresses (e.g., IP addresses) for traversingthrough zero or more CFE from the ingress CFE to the egress CFE.

In addition to internal tunnels, the virtual network in some embodimentsconnects corporate compute nodes to their edge MFNs using VPN tunnels,as mentioned above. Therefore, in the embodiments where secure tunnelsare used to connect the CFEs, the data messages transit through virtualnetwork using an entirely secure VPN path.

As the virtual network data messages are forwarded using encapsulationwithin the virtual network, the virtual network in some embodiments usesits own unique network addresses that are different than the privateaddresses used by the different private networks of the tenant. In otherembodiments, the virtual network uses the private and public networkaddress spaces of the public clouds over which it is defined. In yetother embodiments, the virtual network uses some of its own uniquenetwork addresses for some of its components (e.g., some of its MFNs,CFEs, and/or services), while using the private and public networkaddress spaces of the public clouds for other of its components.

Also, in some embodiments, the virtual network uses a clean-slatecommunication platform with its own proprietary protocols. In theembodiments in which the data messages are forwarded entirely throughsoftware MFN routers (e.g., through software CFEs), the virtual networkcan provide an optimized rate control for long-haul end-to-endconnections. This is accomplished in some embodiments by operating a TCPoptimization proxy engine 220 at every MFN 150. In other embodimentsthat do not break the TCP itself (e.g., with HTTPS), this isaccomplished by the proxy engine 220 segmenting the rate control usingintermediate per-flow buffering together with TCP receiver-window andACK manipulation.

Due to its clean-slate nature, the virtual network in some embodimentsoptimizes many of its components to provide an even better service. Forinstance, in some embodiments, the virtual network uses multiple-pathrouting to support premium bandwidth-guaranteed VPN setups that arerouted across the virtual network. In some embodiments, such VPNsinclude state data in each MFN similar to ATM/MPLS routing, and theirestablishment and removal is centrally controlled. Some embodimentsidentify the available bandwidth per outgoing link, either by measuringit directly (through packet pair or a similar process) or by having agiven capacity for the link and reducing from this capacity the trafficthat is already sent through this link.

Some embodiments use the residual bandwidth of a link as a constraint.For instance, when a link does not have at least 2 Mbps of availablebandwidth, the controller cluster of some embodiments removes the linkfrom the set of links that are used to compute lowest-cost path (e.g.,shortest path) to any destination (e.g., remove the link from therouting graph, such as graph 400). If an end-to-end route is stillavailable after the removal of this link, new VPNs will be routed acrossthis new route. VPN removal can bring back available capacity to a givenlink, which in turn can enable this link to be included in thelowest-cost path (e.g., shortest path) calculation. Some embodiments useother options for multiple-path routing such as load balancing oftraffic across multiple paths, e.g., using MPTCP (multi-path TCP).

Some embodiments provide a better service for premium customers byexploiting the path parallelism and the inexpensive cloud links toduplicate traffic from the ingress MFNs to the egress MFN, through twodisjoint paths (e.g., maximally disjoint paths) within the virtualnetwork. Under this approach, the earliest message that arrives isaccepted, and the later one discarded. This approach increases thevirtual network reliability and reduces the delay, at the cost ofincreasing the egress processing complexity. In some such embodiments,Forward Error Correction (FEC) techniques are used to increasereliability while reducing the duplication traffic. Due to itsclean-slate nature, the virtual network of some embodiments performsother upper-layer optimizations, such as application-layer optimizations(e.g., de-duplication and caching operations) and security optimizations(e.g., the addition of encryption, DPI (deep packet inspection) andfirewalling).

The virtual network of some embodiments accounts for collaboration withcloud providers, to further improve the virtual network setup by usinganycast messaging. For instance, in some embodiments when all MFNsobtain the same external IP address, it is easier to connect any newcorporate compute node to an optimal edge node (e.g., the closest edgenode) using an anycast connection. Likewise, any SaaS provider canobtain this IP address and connect to the optimal MFN (e.g., closestMFN).

As mentioned above, different embodiments use different types of VPNconnections to connect corporate compute nodes (e.g., branches andmobile devices) to the MFNs that establish the virtual network of acorporate entity. Some embodiments use IPsec to set up these VPNconnections. FIG. 6 illustrates the IPsec data message format of someembodiments. Specifically, this figure illustrates an original format ofa data message 605 generated by a machine at the corporate compute node,and an IPsec encapsulated data message 610 after the data message 605has been encapsulated (e.g., at the corporate compute node or the MFN)for transmission through an IPsec tunnel (e.g., to the MFN or to thecorporate compute node).

In this example, the IPsec tunnel is set up with ESP Tunnel Mode, port50. As shown, this mode is set up in this example by replacing the TCPprotocol identifier in the IP header with an ESP protocol identifier.The ESP header identifies the start of the message 615 (i.e., the header620 and payload 625). The message 615 has to be authenticated by therecipient of the IPsec encapsulated data message (e.g., by the IPsecgateway of the MFN). The start of the payload 625 is identified by thevalue of the next field 622 of the message 615. Also, the payload 625 isencrypted. This payload includes the IP header, the TCP header andpayload of the original data message 605, as well as a padding field630, which includes the next field 622.

In some embodiments, each MFN IPsec gateway can handle multiple IPsecconnections for the same or different virtual network tenants (e.g., forthe same corporation or for different corporations). Accordingly, an MFNIPsec gateway (e.g., gateway 230) in some embodiments identifies eachIPsec connection in terms of a tunnel ID, a tenant ID (TID), and acorporate compute node subnet. In some embodiments, different corporatenodes (e.g., different branch offices) of a tenant do not haveoverlapping IP subnets (per RFC 1579). The IPsec gateway in someembodiments has a table mapping each IPsec tunnel ID (which is containedin the IPsec tunnel header) to a tenant ID. For a given tenant that anIPsec gateway is configured to handle, the IPsec gateway also has amapping of all subnets of that tenant that connect to the virtualnetwork established by the MFNs and their cloud forwarding elements.

When an ingress first MFN in a first public cloud datacenter receivesthrough an IPsec tunnel a data message associated with a tenant ID anddestined to a destination (e.g., a branch or datacenter subnet, or aSaaS provider) that connects to an egress second MFN in a second publiccloud datacenter, the IPsec gateway of the first MFN removes the IPsectunnel header. In some embodiments, the CFE of the first MFN thenencapsulates the message with two encapsulating headers that allow themessage to traverse a path from the ingress first MFN to the egresssecond MFN, directly or through one or more other intermediate MFNs. TheCFE of the first MFN identifies this path by using itscontroller-configured routing table.

As mentioned above, the two encapsulating headers in some embodimentsinclude (1) an outer header that specifies the next hop MFN CFE to allowthe encapsulated data message to traverse through the MFNs of thevirtual network to reach the egress MFN CFE, and (2) an inner headerthat specifies the tenant ID and the ingress and egress MFN CFEs thatidentify the MFNs for the data message entering and exiting the virtualnetwork.

Specifically, in some embodiments, the inner encapsulating headerincludes a valid IP header with the destination IP address of the egresssecond MFN's CFE and the source IP address of the ingress first MFN'sCFE. This approach allows standard IP router software to be used inevery CFE of the MFNs. The encapsulation further includes the tenant ID(e.g., a customer CID). When a message arrives at the egress secondMFN's CFE, it is decapsulated and sent by the second MFN to itsdestination (e.g., sent by the second MFN's IPsec gateway to thedestination via another IPsec tunnel that is associated with the tenantID and the destination subnet of the message).

Certain cloud providers prohibit machines from “spoofing” source IP,and/or impose other restrictions for TCP and UDP traffic. To deal withsuch possible restrictions, some embodiments use the outer header toconnect neighboring pairs of MFNs that are used by one or more routes.This header in some embodiments is a UDP header that specifies sourceand destination IP addresses and the UDP protocol parameters. In someembodiments, the ingress MFN CFE specifies its IP address as the sourceIP address of the outer header, while specifying the next MFN CFE hop'sIP address as the destination IP address of the outer header.

When the path to the egress MFN's CFE includes one or more intermediateMFN CFEs, an intermediate CFE replaces the source IP address in theouter header of the double-encapsulated message that it receives withits IP address. It also uses the destination IP address in the innerheader to perform a route lookup in its routing table to identify thedestination IP address of the next hop MFN CFE that is on the path tothe destination IP address of the inner header. The intermediate CFEthen replaces the destination IP address in the outer header with the IPaddress that it identified through its route table lookup.

When the double encapsulated data message reaches the egress MFN's CFE,the CFE determines that it is the egress node for the data message whenit retrieves the destination IP address in the inner header anddetermines that this destination IP address belongs to it. This CFE thenremoves the two encapsulating headers from the data message and thensends it to it destination (e.g., through its MFN's IPsec gateway to thedestination via another IPsec tunnel that is associated with the tenantID and the destination IP address or subnet in the data message'soriginal header).

FIG. 7 illustrates an example of the two encapsulating headers of someembodiments, while FIG. 8 presents an example that illustrates how thesetwo headers are used in some embodiments. In the discussion below, theinner header is referred to as the tenant header as it includes thetenant ID along with the identity of the virtual-network ingress/egressnodes connected to the tenant's corporate compute end nodes. The outerheader is referred to below as the VN-hop tunnel header because it isused to identify the next hop through the virtual network as the datamessage traverses a path through the virtual network between ingress andegress MFN CFEs.

FIG. 7 shows a VN-hop tunnel header 705 and a tenant tunnel header 720encapsulating an original data message 750 with an original header 755and a payload 760. As shown, the VN-hop tunnel header 705 in someembodiments includes a UDP header 710 and an IP header 715. The UDPheader in some embodiments is defined according to a UDP protocol. Insome embodiments, the VN-hop tunnel is a standard UDP tunnel, while inother embodiments, this tunnel is a proprietary UDP tunnel. In stillother embodiments, this tunnel is a standard or proprietary TCP tunnel.The tunnel header 705 in some embodiments is an encrypted one thatencrypts its payload, while in other embodiments it is an unencryptedtunnel.

As further described below, the tunnel header 705 in some embodiments isused to define an overlay VNP network, and is used by each MFN CFE toreach the next hop MFN CFE over the underlay public cloud networks. Assuch, the IP header 715 of the tunnel header 705 identifies the sourceand destination IP addresses of the first and second CFEs of the firstand second neighboring MFNs connected by the VNP tunnel. In some cases(e.g., when the next hop destination MFN is in a different public cloudof a different public cloud vendor than the source MFN), the source anddestination IP addresses are public IP addresses that are used by thepublic cloud datacenters that include the MFNs. In other cases, when thesource and destination MFN CFEs belong to the same public cloud, thesource and destination IP addresses can be private IP addresses that areused in just the public cloud. Alternatively, in such cases, the sourceand destination IP addresses might still be public IP addresses of thepublic cloud vendor.

As shown in FIG. 7 , the tenant tunnel header 720 includes an IP header725, a tenant ID field 730 and a virtual circuit label (VCL) 735. Thetenant tunnel header 720 is used by each hop CFE after the ingress hopCFE to identify the next hop for forwarding the data message to theegress CFE of the egress MFN. As such, the IP header 725 includes asource IP address that is the IP address of the ingress CFE and adestination IP address that is the IP address of the egress CFE. As withthe source and destination IP addresses of the VN-hop header 705, thesource and destination IP addresses of the tenant header 720 can beeither private IP addresses of one public cloud provider (when the datamessage traverses a route that only goes through one public cloudprovider's datacenter), or public IP addresses of one or more publiccloud providers (e.g., when the data message traverses a route that goesthrough datacenters of two or more public cloud providers).

The IP header of the tenant header 720 can be routed by using anystandard software router and IP routing table in some embodiments. Thetenant ID field 730 contains the tenant ID, which is a unique tenantidentifier that can be used at the ingress and egress MFNs to uniquelyidentify a tenant. The virtual network provider in some embodimentsdefines different tenant IDs for different corporate entities that aretenants of the provider. The VCL field 735 is an optional routing fieldthat some embodiments use to provide an alternative way (non-IP basedway) for forwarding messages through the network. In some embodiments,the tenant tunnel header 720 is a GUE (Generic UDP Encapsulation)header.

FIG. 8 presents an example that illustrates how these two tunnel headers705 and 710 are used in some embodiments. In this example, a datamessages 800 is sent from a first machine 802 (e.g., first VM) in afirst branch office 805 of a company to a second machine 804 (e.g., asecond VM) in a second branch office 810 of the company. The twomachines are in two different subnets, which are 10.1.0.0 and 10.2.0.0,with the first machine having an IP address 10.1.0.17 and the secondmachine having an IP address 10.2.0.22. In this example, the firstbranch 805 connects to an ingress MFN 850 in a first public clouddatacenter 830, while the second branch 810 connects to an egress MFN855 in a second public cloud datacenter 838. Also, in this example, theingress and egress MFNs 850 and 855 of the first and second public clouddatacenters are indirectly connected through an intermediate MFN 857 ofa third public cloud datacenter 836.

As shown, the data message 800 from machine 802 is sent to the ingressMFN 850 along an IPsec tunnel 870 that connects the first branch office805 to the ingress MFN 850. This IPsec tunnel 870 is established betweenan IPsec gateway 848 of the first branch office and an IPsec gateway 852of the ingress MFN 850. This tunnel is established by encapsulating thedata message 800 with an IPsec tunnel header 806.

The IPsec gateway 852 of the MFN 850 decapsulates the data message(i.e., removes the IPsec tunnel header 806), and passes the decapsulatedmessage to this MFN's CFE 832 directly or through one or more middleboxservice machines (e.g., through a firewall machine, such as machine 210of FIG. 2 ). In passing this message, the IPsec gateway or some othermodule of the MFN 850 in some embodiments associates the message withthe tunnel ID of the IPsec tunnel and a tenant ID of the company. Thistenant ID identifies the company in the records of the virtual networkprovider.

Based on the associated tenant ID and/or the IPsec tunnel ID, the CFE832 of the ingress MFN 850 identifies a route for the message to itsdestination machine's subnet (i.e., to the second branch office 810)through the virtual network that is established by the MFNs in thedifferent public cloud datacenters. For instance, the CFE 832 uses thetenant ID and/or the IPsec tunnel ID to identify the routing table forthe company. In this routing table, the CFE 832 then uses thedestination IP address 10.2.0.22 of the received message to identify arecord that identifies the CFE 853 of the egress MFN 855 of the publiccloud datacenter 838 as the destination egress forwarding node for thedata message 800. In some embodiments, the identified record maps theentire subnet 10.2.0.0/16 of the second branch office 810 to the CFE 853of the MFN 855.

After identifying the egress CFE 853, the CFE 832 of the ingress MFN 850encapsulates the received data message with a tenant tunnel header 860that in its IP header 725 includes the source IP of the ingress CFE 832and the destination IP of the egress CFE 853. In some embodiments, theseIP addresses are defined in the public IP address space. The tunnelheader 860 also includes the tenant ID that was associated with the datamessage at ingress MFN 850. As mentioned above, this tunnel header alsoincludes the VCL header value in some embodiments.

In some embodiments, the ingress CFE 832 also identifies the next hopMFN that is on the desired CFE routing path to the egress CFE 853. Insome embodiments, the ingress CFE 832 identifies this next hop CFE inits routing table by using the destination IP address of the egress CFE853. The next hop MFN CFE in this example is the CFE 856 of the thirdMFN 857 of a third public cloud datacenter 836.

After identifying the next hop MFN CFE, the ingress MFN CFE encapsulatesthe encapsulated data message 800 with a VN-hop, second tunnel header862. This tunnel header allows the message to route to the next hop CFE856. In the IP header 715 of this outer header 862, ingress MFN CFE 832specifies the source and destination IP addresses as the source IP ofthe ingress CFE 832 and the destination IP of the intermediate CFE 856.It also specifies its layer 4 protocol as being UDP in some embodiments.

When the CFE 856 of the third MFN 857 receives the double-encapsulateddata message, it removes the VN-hop, second tunnel header 862, and theextracts from the tenant header 860 the destination IP address of theCFE 853 of the egress MFN 855. Since this IP address is not associatedwith the CFE 856, the data message still has to traverse to another MFNto reach its destination. Accordingly, the CFE 856 uses the extracteddestination IP address to identify a record in its routing table thatidentifies the next hop MFN CFE 853. It then changes re-encapsulates thedata message with the outer header 705 and specifies the source anddestination IP addresses in its IP header 715 as its own IP address andthe destination IP address of the MFN CFE 853. Next, the CFE 856forwards the double-encapsulated data message 800 to the egress CFE 853through intervening routing fabric of the public cloud datacenters 836and 838.

After receiving the encapsulated data message, the egress CFE 853determines that the encapsulated message is directed to it when itretrieves the destination IP address in the inner header 860 anddetermines that this destination IP address belongs to it. The egressCFE 853 removes both encapsulating headers 860 and 862 from the datamessage 800, and extracts the destination IP address in the datamessage's original header. This destination IP address identifies the IPaddress of the second machine 804 in the second branch office's subnet.

Using the tenant ID in the removed tenant tunnel header 860, the egressCFE 853 identifies the correct routing table to search, and thensearches this routing table based on the destination IP addressextracted from the original header value of the received data message.From this search, the egress CFE 853 identifies a record that identifiesthe IPsec connection to use to forward the data message to itsdestination. It then provides the data message along with the IPsecconnection identifier to the second MFN's IPsec gateway 858, which thenencapsulates this message with an IPsec tunnel header 859 and thenforwards it to an IPsec gateway 854 of the second branch office 810. Thegateway 854 then removes the IPsec tunnel header and forwards the datamessage to its destination machine 804.

Several more detailed message-processing examples will now be describedby reference to FIGS. 9-15 . In these examples, it is assumed that eachtenant IPsec interface is on the same local public IP address, as arethe VNP tunnels. As such, the interfaces in some embodiments areattached to a single VRF (virtual routing and forwarding) namespace.This VRF namespace is referred to below as the VNP namespace.

FIGS. 9-11 illustrate message-handling processes 900-1100 that areperformed respectively by the ingress, intermediate, and egress MFNswhen they receive a message that is sent between two compute devices intwo different external machine locations (e.g., branch offices,datacenters, etc.) of a tenant. In some embodiments, the controllercluster 160 configures the CFE of each MFN to operate as an ingress,intermediate, and egress CFE, when each such CFE is a candidate to serveas an ingress, intermediate and egress CFE for different data messageflows of a tenant.

The processes 900-1100 will be explained below by reference to twoexamples in FIGS. 8 and 12 . As mentioned above, FIG. 8 illustrates anexample when the data message goes through an intermediate MFN to get tothe egress MFN. FIG. 12 illustrates an example that does not involve anintermediate MFN between the ingress and egress MFNs. Specifically, itillustrates a data message 1200 being sent from a first device 1202 in afirst branch office 1205 to a second device 1210 in a second branchoffice 1220 when the two branch offices connect to two public clouddatacenters 1230 and 1238 with two MFNs 1250 and 1255 that are directlyconnected. As shown, the CFEs 1232 and 1253 of the MFNs in theseexamples perform the routing operations associated with each MFN.

The ingress CFE (e.g., ingress CFE 832 or 1232) of the ingress MFNs 850and 1250 perform the process 900 in some embodiments. As shown in FIG. 9, the ingress process 900 starts by initially identifying (at 905) thetenant routing context based on the identifier of the IPsec tunnel(e.g., 806 or 1206) in the received data message. In some embodiments,the IPsec gateways or other MFN modules store the tenant IDs for theIPsec tunnel IDs in mapping tables. Whenever a data message is receivedalong a particular IPsec tunnel, the IPsec gateway extracts the IPsectunnel ID, which this gateway or another MFN module then uses toidentify the associated tenant ID by reference to its mapping table. Byidentifying the tenant ID, the process identifies the tenant routingtable or the tenant portion of the VRF namespace to use.

At 910, the process increments the identified IPsec tunnel's RX(receive) counter to account for receiving this data message. Next, at915, the process performs a route lookup (e.g., a longest prefix match,LPM, lookup) in the identified tenant routing context (e.g., in thetenant's portion of the VRF namespace) to identify the IP address of theegress interface for exiting the tenant's virtual network that is builtover the public cloud datacenters. For the branch-to-branch examples,the egress interface is the IP address of an egress CFE (e.g., CFE 853or 1253) of an MFN connected to the destination branch.

At 920, the process adds a tenant tunnel header (e.g., header 860 or1260) to the received data message, and embeds the source IP address ofthe ingress CFE (e.g., ingress CFE 832 or 1252) and the destination IPaddress of the egress CFE (e.g., egress CFE 853 or 1253) as the sourceand destination IP addresses in this tunnel header. In the tenantheader, the process also stores the tenant ID (identified at 905) in thetenant header. At 920, the process adds a VN-hop tunnel header (e.g.,header 862 or 1262) outside of the tenant header, and stores its IPaddress as the source IP address in this header. The process alsospecifies (at 920) the UDP parameters (e.g., UDP port) of the VNP tunnelheader.

Next, at 925, the process increments the VN-transmit counter for thetenant to account for this data message's transmission. At 930, theprocess performs a route lookup (e.g., an LPM lookup) in the identifiedVNP routing context (e.g., in the VNP's portion of the VRF namespace) toidentify the next hop interface for this data message. In someembodiments, this route lookup is an LPM lookup (e.g., in the VNP'sportion of the VRF namespace) that is at least partially based on theegress CFE's destination IP.

At 935, the process determines whether the next hop egress interface isa local interface (e.g., a physical or virtual port) of the ingress CFE.If so, the process defines (at 937) the destination IP address in theVN-hop outer tunnel header as the egress interface IP address identifiedat 915. Next, at 940, the process provides the double encapsulated datamessage to its local interface so that it can be forwarded to thedestination egress CFE. After 940, the process 900 ends.

FIG. 12 illustrates an example of the operation 905-940 for the datamessage 1200 that the ingress CFE 1232 receives from the device 1202 ofthe first branch office 1205. As shown, this CFE's MFN 1250 receivesthis data message as an IPsec encapsulated message at its IPsec gateway1252 from the IPsec gateway 1248 of the first branch office 1205. Theingress CFE 1232 encapsulates the received message 1200 (after its IPsecheader has been removed by an IPsec gateway 1252) with a VN-hop tunnelheader 1262 and a tenant tunnel header 1260, and forwards this doubleencapsulated message to the egress CFE 1253 of MFN 1255 of public cloud1238. As shown, the source and destination IP addresses of both tunnelheaders 1260 and 1262 are identical in this example. Given that thesetwo sets of IP addresses are identical, some embodiments forego usingthe outer IP header 1262 when the data message is not routed through anyintervening CFE, such as CFE 856.

When the process determines (at 935) that the next hop egress interfaceis not a local interface of the ingress CFE but rather is thedestination IP address of another router, the process embeds (at 945) inthe VN-hop tunnel header, the destination IP address of the next hopintermediate CFE (e.g., intermediate CFE 856) as the destination IPaddress of the VN-hop tunnel header.

Next, at 950, the process performs another route lookup (e.g., an LPMlookup) in the identified VNP routing context (e.g., in the VNP'sportion of the VRF namespace). This time, the lookup is based on the IPaddress of the intermediate CFE that is identified in the VNP tunnelheader. As the intermediate CFE (e.g., CFE 856) is a next-hop CFE in thevirtual network for the ingress CFE (e.g., CFE 832), the routing tableidentifies a local interface (e.g., a local port) for data messages sentto the intermediate CFE. Thus, this lookup in the VNP routing contextidentifies a local interface, to which the ingress CFE provides (at 950)the double-encapsulated message. The process then increments (at 955)the VN-intermediate counter to account for this data message'stransmission. After 955, the process ends.

FIG. 10 illustrates a process 1000 that a CFE (e.g., CFE 853 or 1253) ofan egress MFN performs in some embodiments when it receives a datamessage that should be forwarded to a corporate compute node (e.g., abranch office, datacenter, remote user location) connected to the MFN.As shown, the process initially receives (at 1005) the data message onan interface associated with the virtual network. This message isencapsulated with the VN-hop tunnel header (e.g., header 862 or 1262)and tenant tunnel header (e.g., header 860 or 1260).

At 1010, the process determines that the destination IP address in theVN-hop tunnel header is its CFE's destination IP address (e.g., IPaddress of CFE 853 or 1253). Next, at 1015, the process removed the twotunnel headers. The process then retrieves (at 1020) the tenant ID fromthe removed tenant tunnel header. To account for the received datamessage, the CFE then increments (at 1025) the RX (receive) counter thatit maintains for the tenant specified by the extracted tenant ID.

Next, at 1030, the process performs a route lookup (e.g., an LPM lookup)in the identified tenant routing context (i.e., in the routing contextof the tenant identified by the tenant ID extracted at 1020) to identifythe next hop interface for this data message. The process performs thislookup based on the destination IP address in the original header (e.g.,header 755) of the received data message in some embodiments. From therecord identified through this lookup, the process 1000 identifies theIPsec interface through which the data message has to be sent to itsdestination. Accordingly, the process 1000 sends the decapsulated,received data message to its MFN's IPsec gateway (e.g., gateway 858 or1258).

This gateway then encapsulates the data message with an IPsec tunnelheader (e.g., tunnel header 859 or 1259) and forwards it to a gateway(e.g., gateway 854 or 1254) in the destination corporate compute node(e.g., destination branch office), where it will be decapsulated andforwarded to its destination. After 1030, the CFE or its MFN increments(at 1035) the counter that it maintains for transmitting messages alongthe IPsec connection to the destination corporate compute node (e.g.,the IP sec connection between gateways 854 and 858, or between gateways1254 and 1258).

FIG. 11 illustrates a process 1100 that a CFE (e.g., CFE 856) of anintermediate MFN performs in some embodiments when it receives a datamessage that should be forwarded to another CFE of another MFN. Asshown, the process initially receives (at 1105) the data message on aninterface associated with the virtual network. In some embodiments, thismessage is encapsulated with two tunnel headers, a VN-tunnel header(e.g., header 862) and a tenant tunnel header (e.g., header 860).

At 1110, the process terminates the VN-hop tunnel as it determines thatthe destination IP address in this tunnel header is its CFE'sdestination IP address (e.g., is the destination IP address of CFE 856).Next, at 1115, the process determines whether the VN-hop tunnel headerspecifies the correct UDP port. If not, the process ends. Otherwise, at1120, the process removes the VN-hop tunnel header. To account for thereceived data message, the CFE then increments (at 1125) the RX(receive) counter that it maintains to quantify the number of messagesthat it has received as an intermediate hop CFE.

At 1130, the process performs a route lookup (e.g., an LPM lookup) inthe identified VNP routing context (e.g., in the VNP's portion of theVRF namespace) to identify the next hop interface for this data message.In some embodiments, this route lookup is an LPM lookup (e.g., in theVNP's portion of the VRF namespace) that is at least partially based onthe egress CFE's destination IP that is identified in the inner tenanttunnel header.

The process then determines (at 1135) whether the next hop egressinterface is a local interface of the intermediate CFE. If so, theprocess adds (at 1140) the VN-hop tunnel header to the data message,which is already encapsulated with the tenant tunnel header. The processsets (at 1142) the destination IP address in the VN-hop tunnel header tothe egress CFE's destination IP address that is specified in the tenanttunnel header. It also sets (at 1142) the source IP address in theVN-hop tunnel header to the IP address of its CFE. In this tunnelheader, the process also sets the UDP attributes (e.g., the UDP port,etc.).

Next, at 1144, the process provides the double encapsulated data messageto its local interface (identified at 1130) so that it can be forwardedto the destination egress CFE. One example of this VN-hop tunnelde-capsulation and forwarding was described above by reference to theoperations of CFE 856 in FIG. 8 . To account for the received datamessage, the CFE then increments (at 1146) the TX (transmit) counterthat it maintains to quantify the number of messages that it hastransmitted as an intermediate hop CFE. After 1146, the process 1100ends.

On the other hand, when the process determines (at 1135) that the nexthop egress interface is not a local interface of its CFE but rather isthe destination IP address of another router, the process adds (at 1150)a VN-hop tunnel header to the data message from which it previouslyremoved a VN-hop tunnel header. In the new VN-hop tunnel header, theprocess 1100 embeds (at 1150) the source IP address of its CFE and thedestination IP address (identified at 1130) of the next hop intermediateCFE as the source and destination IP addresses of the VN-hop tunnelheader. This VNP tunnel header also specifies a UDP layer 4 protocolwith a UDP destination port.

Next, at 1155, the process performs another route lookup (e.g., an LPMlookup) in the identified VNP routing context (e.g., in the VNP'sportion of the VRF namespace). This time, the lookup is based on the IPaddress of the next hop intermediate CFE that is identified in the newVN-hop tunnel header. As this intermediate CFE is a next-hop of thecurrent intermediate CFE in the virtual network, the routing tableidentifies a local interface for data messages sent to the next-hopintermediate CFE. Thus, this lookup in the VNP routing contextidentifies a local interface, to which the current intermediate CFEprovides the double-encapsulated message. The process then increments(at 1160) the VN-intermediate TX (transmit) counter to account for thisdata message's transmission. After 1160, the process ends.

FIG. 13 illustrates a message-handling process 1300 that is performed bythe CFE of the ingress MFN when it receives a message for a tenant thatis sent from a corporate compute device of the tenant (e.g., in a branchoffice) to another tenant machine (e.g., in another branch office,tenant datacenter or a SaaS provider datacenter). The process 900 ofFIG. 9 is a subset of this process 1300 as further described below. Asshown in FIG. 13 , the process 1300 starts by initially identifying (at905) the tenant routing context based on the identifier of the incomingIPsec tunnel.

At 1310, the process determines whether both the source and destinationIP addresses in the received data message's header are public IPaddresses. If so, the process (at 1315) drops the data message andincrements the drop counter that it maintains for the received datamessage's IPsec tunnel. At 1315, the process drops the counter becauseit should not be receiving messages that are addressed to and frompublic IP addresses when it receives the messages through the tenant'sIPsec tunnel. In some embodiments, the process 1300 also sends back tothe source corporate compute machine an ICMP error message.

On the other hand, when the process determines (at 1310) that the datamessage is not coming from a public IP address and going to anotherpublic IP address, the process determines (at 1320) whether thedestination IP address in the received data message's header is a publicIP address. If so, the process transitions to 1325 to perform process900 of FIG. 9 , with the exception of operation 905, which it hasperformed at the start of the process 1300. After 1325, the process 1300ends. On the other hand, when the process 1300 determines (at 1320) thatthe destination IP address in the received data message's header is nota public IP address, the process increments (at 1330) the identifiedIPsec tunnel's RX (receive) counter to account for receiving this datamessage.

The process 1300 then performs (at 1335) a route lookup (e.g., an LPMlookup) in the identified tenant routing context (e.g., in the tenant'sportion of the VRF namespace). This lookup identifies the IP address ofthe egress interface for exiting the tenant's virtual network that isbuilt over the public cloud datacenters. In the example illustrated inFIG. 13 , the process 1300 reaches the lookup operation 1335 when thedata message is intended for a machine in a SaaS provider datacenter.Hence, this lookup identifies the IP address of the egress router forexiting the tenant's virtual network to reach the SaaS provider machine.In some embodiments, all the SaaS provider routes are installed in oneroute table or in one portion of the VRF namespace, while in otherembodiments the routes for the different SaaS providers are stored indifferent route tables or different VRF namespace portions.

At 1340, the process adds a tenant tunnel header to the received datamessage, and embeds the source IP address of the ingress CFE and thedestination IP address of the egress router as the source anddestination IP addresses in this tunnel header. Next, at 1345, theprocess increments the VN-transmit counter for the tenant to account forthis data message's transmission. At 1350, the process performs a routelookup (e.g., an LPM lookup) in the VNP routing context (e.g., in theVNP's portion of the VRF namespace) to identify one of its localinterfaces as the next hop interface for this data message. When thenext hop is another CFE (e.g., in other public cloud datacenter), theprocess in some embodiments further encapsulates the data message withthe VN-hop header, and embeds its CFE's IP address and the other CFE'sIP address as the source and destination addresses of the VN-hop header.At 1355, the process provides the encapsulated data message to itsidentified local interface so that the data message can be forwarded toits egress router. After 1355, the process 1300 ends.

In some cases, the ingress MFN can receive a data message for a tenantthat its CFE can directly forward to the data message's destinationmachine without going through another MFN's CFE. In some such cases, thedata message does not need to be encapsulated with a tenant header or aVN-hop header when the CFE does not need to relay any tenant specificinformation to any other subsequent VN processing module or the neededinformation can be provided to the subsequent VN processing modulethrough other mechanisms.

For instance, to directly forward a tenant's data message to an externalSaaS provider datacenter, the ingress MFN's NAT engine 215 would have toperform a NAT operation based on the tenant identifier, as furtherdescribed below. The ingress CFE or another module in the ingress MFNhas to provide the tenant identifier to the ingress MFN's associated NATengine 215. When the ingress CFE and NAT engines execute on the samecomputer, some embodiments share this information between these twomodules by storing it in a shared memory location. On the other hand,when the CFE and NAT engines do not execute on the same computer, someembodiments use other mechanisms (e.g., an out-of-band communication) toshare the tenant ID between the ingress CFE and NAT engines. In suchcases, however, other embodiments use an encapsulating header (i.e., usean in-band communication) to store and share the tenant ID betweendifferent modules of the ingress MFN.

As further described below, some embodiments perform one or two sourceNAT operations on the source IP/port addresses of a data message beforesending the message outside of the virtual network of a tenant. FIG. 14illustrates the NAT operation being performed at the egress router.However, as further described below, some embodiments also performanother NAT operation on the data message at the ingress router, eventhough this extra NAT operation was not described above by reference toFIG. 13 .

FIG. 14 illustrates a process 1400 that an egress router performs insome embodiments when it receives a data message that should beforwarded to a SaaS provider datacenter through the Internet. As shown,the process initially receives (at 1405) the data message on aninterface associated with the virtual network. This message isencapsulated with the tenant tunnel header.

At 1410, the process determines that the destination IP address in thistunnel header is its router's destination IP address, and hence itremoves the tenant tunnel header. The process then retrieves (at 1415)the tenant ID from the removed tunnel header. To account for thereceived data message, the process increments (at 1420) the RX (receive)counter that it maintains for the tenant specified by the extractedtenant ID.

Next, at 1425, the process determines whether the destination IP in thedata message's original header is a public one that is reachable througha local interface (e.g., local port) of the egress router. This localinterface is an interface that is not associated with a VNP tunnel. Ifnot, the process ends. Otherwise, the process performs (at 1430) asource NAT operation to change the source IP/port addresses of the datamessage in this message's header. The NAT operation and the reason forperforming it will be further described below by reference to FIGS. 16and 17 .

After 1430, the process performs (at 1435) a route lookup (e.g., an LPMlookup) in the Internet routing context (i.e., in the Internet routingportion of the routing data, e.g., Internet VRF namespace of the router)to identify the next hop interface for this data message. The processperforms this lookup based on the destination network address (e.g.,destination IP address) of the original header of the received datamessage in some embodiments. From the record identified through thislookup, the process 1400 identifies the local interface through whichthe data message has to be sent to its destination. Accordingly, at1435, the process 1400 provides the source network-address translateddata message to its identified local interface for forwarding to itsdestination. After 1435, the process increments (at 1440) the counterthat it maintains for transmitting messages to the SaaS provider, andthen ends.

FIG. 15 illustrate a message-handling process 1500 that is performed bythe ingress router that receives a message that is sent from a SaaSprovider machine to a tenant machine. As shown, the ingress process 1500starts by initially receiving (at 1505) a data message on a dedicatedinput interface with a public IP address that is used for several or allSaaS provider communications. In some embodiments, this input interfaceis a different interface with a different IP address than the one usedfor communicating with the virtual network.

After receiving the message, the process performs (at 1510) a routelookup in a public Internet routing context by using the destination IPaddress contained in the received data message's header. Based on thislookup, the process determines (at 1515) whether the destination IPaddress is local and associated with an enabled NAT operation. If not,the process ends. Otherwise, the process increments (at 1520) theInternet RX (receive) counter to account for receiving the data message.

Next, at 1525, the process performs a reverse NAT operation thattranslates the destination IP/port addresses of the data message to newdestination IP/port addresses that the virtual network associates with aparticular tenant. This NAT operation also produces the tenant ID (e.g.,retrieves the tenant ID from a mapping table that associates tenant IDswith translated destination IPs, or retrieves the tenant ID from thesame mapping table that is used to obtain the new destination IP/portaddresses). In some embodiments, the process 1500 uses a connectionrecord that the process 1400 created when it performed (at 1430) itsSNAT operation to perform (at 1525) its reverse NAT operation. Thisconnection record contains the mapping between the internal and externalIP/port addresses that are used by the SNAT and DNAT operations.

Based on the translated destination network address, the process thenperforms (at 1530) a route lookup (e.g., an LPM lookup) in theidentified tenant routing context (i.e., the routing context specifiedby the tenant ID) to identify the IP address of the egress interface forexiting the tenant's virtual network and reaching the tenant's machinein a corporate compute node (e.g., in a branch office). This egressinterface is the IP address of an egress CFE of an egress MFN in someembodiments. At 1530, the process adds a tenant tunnel header to thereceived data message, and embeds the IP address of the ingress routerand the IP address of the egress CFE as the source and destination IPaddresses in this tunnel header. Next, at 1535, the process incrementsthe VN-transmit counter for the tenant to account for this datamessage's transmission.

At 1540, the process performs a route lookup (e.g., an LPM lookup) inthe identified VNP routing context (e.g., in the VNP's portion of therouting data, such as in the VRF namespace of the router) to identifyits local interface (e.g., its physical or virtual port), to which theingress router provides the encapsulated message. The process then adds(at 1540) a VN-hop header to the received data message, and embeds theIP address of the ingress router and the IP address of the next hop CFEas the source and destination IP addresses of this VN-hop header. After1555, the process ends.

As mentioned above, the MFNs in some embodiments include NAT engines 215that perform NAT operations on the ingress and/or egress paths of datamessages into and out of the virtual network. NAT operations arecommonly performed today in many contexts and by many devices (e.g.,routers, firewalls, etc.). For instance, a NAT operation is typicallyperformed when traffic exits a private network to isolate the internalIP address space from the regulated, public IP address space used in theInternet. A NAT operation typically maps one IP address to another IPaddress.

With the proliferation of computers connected to the Internet, thechallenge is that the number of computers would exceed the availablenumber of IP Addresses. Unfortunately, even though there are4,294,967,296 possible unique addresses, it is already not practical toassign a unique public IP address for each computer. One way to getaround is to assign public IP addresses only to the routers at the edgepoint of private networks, while other devices inside the networks getaddresses that are only unique in their internal private networks. Whena device wants to communicate with a device outside of its internalprivate network, its traffic typically passes through an Internetgateway that performs a NAT operation to replace the source IP of thistraffic with the public source IP address of the Internet gateway.

While a private network's Internet gateway gets a registered publicaddress on the Internet, each device inside of a private network thatconnects to this gateway receives an unregistered private address. Theprivate addresses of the internal private networks can be in any rangeof IP addresses. However, the Internet Engineering Task Force (IETF) hassuggested several ranges of private addresses for private networks touse. These ranges are generally not available on the public Internet sothat routers can easily distinguish between private and publicaddresses. These ranges of private addresses are known as RFC 1918, andare: (1) Class A 10.0.0.0-10.255.255.255, (2) Class B172.16.0.0-172.31.255.255, and (3) Class C 192.168.0.0-192.168.255.255.

It is important to perform source IP translation on data message flowsexiting private networks, so that external devices can differentiatedifferent devices within different private networks that use the sameinternal IP addresses. When an external device has to send a replymessage to the device inside of a private network, the external devicehas to send its reply to a unique and routable public address on theInternet. It cannot use the internal device's original IP address thatmight be used by numerous devices in numerous private networks. Theexternal device sends its reply to the public IP address with which theoriginal NAT operation replaced the private source IP address of theinternal device. After receiving this reply message, the private network(e.g., the network's gateway) performs another NAT operation to replacethe public destination IP address in the reply with the IP address ofthe internal device.

Many devices inside of a private network and many applications executingon these devices have to share one or a finite number of public IPaddress that are associated with the private network. Accordingly, NAToperations typically also translate the layer 4 port addresses (e.g. UDPaddresses, TCP addresses, RTP addresses, etc.) to be able to uniquelyassociate external message flows to internal message flows that start orterminate on different internal machines and/or different applicationson these machines. NAT operations are also often stateful operations asin many contexts these operations need to track connections, anddynamically handle tables, message reassembly, timeouts, forcedtermination of expired tracked connections, etc.

As mentioned above, the virtual network provider of some embodimentsprovides a virtual network as a service to different tenants overmultiple public clouds. These tenants might use common IP addresses intheir private networks and they share a common set of network resources(e.g., public IP addresses) of the virtual network provider. In someembodiments, the data traffic of the different tenants is carriedbetween the overlay network's CFEs through tunnels and the tunnel markseach message with a unique tenant ID. These tenant identifiers allow themessages to be sent back to the source devices even when the privatetenant IP spaces overlap. For instance, the tenant identifiers allow amessage that is sent from a branch office of tenant 17 with sourceaddress 10.5.12.1 to Amazon.com to be distinguished from a message sentto Amazon.com from a branch office of tenant 235 with the same sourceaddress (and even with the same source port number, 55331).

Standard NATs implemented according to RFC 1631 do not support thenotion of tenancy and consequently have no way to distinguish betweentwo messages with the same private IP addresses. However, in manyvirtual network deployments of some embodiments, it is beneficial to usestandard NAT engines as many mature open-source, high-performanceimplementations exist today. In fact, many Linux kernels today havefunctioning NAT engines as standard features.

In order to use standard NAT engines for different tenants of tenantvirtual networks, the virtual network provider of some embodiments usestenancy-mapping (TM) engines before using standard NAT engines. FIG. 16illustrates such TM engines 1605 that are placed in each virtual-networkgateway 1602 that is on the virtual network's egress path to theInternet. As shown, each TM engine 1605 is placed before a NAT engine1610 on the message egress paths to SaaS provider datacenters 1620through the Internet 1625. In some embodiments, each NAT engine 215 ofan MFN includes a TM engine (like the TM engine 1605) and a standard NATengine (like NAT engine 1610).

In the example illustrated in FIG. 16 , the message flows come from twobranch offices 1655 and 1660 and a datacenter 1665 of twovirtual-network tenants, and enter the virtual network 1600 through thesame ingress gateway 1670, although this does not necessarily have to bethe case. The virtual network 1600 in some embodiments is defined overmultiple public cloud datacenters of multiple public cloud vendors. Insome embodiments, the virtual-network gateways are part of the managedforwarding nodes, and the TM engines are placed before the NAT engines1610 in egress MFNs.

When a data message reaches an egress gateway 1602 to exit the virtualnetwork on its way to a SaaS provider datacenter 1620, each TM engine1605 maps the source network address (e.g., source IP and/or portaddresses) of these data message to new source network address (e.g.,source IP and/or port addresses), and the NAT engine 1610 maps the newsource network address to yet another source network address (e.g.,another source IP and/or port addresses). In some embodiments, the TMengine is a stateless element and performs the mapping for each messagethrough a static table without looking at any dynamic data structure. Asa stateless element, the TM engine does not create a connection recordwhen it processes a first data message of a data message flow in orderto use this connection record in performing its address mapping forprocessing subsequent messages of the data message flow.

On the other hand, the NAT engine 1605 in some embodiments is a statefulelement that performs its mapping by reference to a connection storagethat stores connection records that reflect its prior SNAT mappings.When the NAT engine receives a data message, this engine in someembodiments first checks it connection storage to determine whether itpreviously created a connection record for the received message's flow.If so, the NAT engine uses the mapping contained in this record toperform its SNAT operation. Otherwise, it performs the SNAT operationbased on a set of criteria that it uses to derive a new address mappingfor the new data message flow. To do this, the NAT engine in someembodiments uses common network address translation techniques.

In some embodiments, the NAT engine can also use the connection storagein some embodiments when it receives a reply data message from the SaaSprovider machine, in order to perform a DNAT operation to forward thereply data message to the tenant machine that sent the original message.In some embodiments, the connection record for each processed datamessage flow has a record identifier that includes the flow's identifier(e.g., five tuple identifier with the translated source networkaddress).

In doing its mapping, the TM engines ensure that data message flows fromdifferent tenants that use the same source IP and port addresses aremapped to unique non-overlapping address spaces. For each message, theTM engine identifies the tenant ID and performs its address mappingbased on this identifier. In some embodiments, the TM engine maps thesource IP addresses of different tenants into different IP ranges suchthat any two messages from different tenants will not be mapped to thesame IP address.

Consequently, each network type with a different tenant ID will map intoa unique address within the full 2³² region of IP address(0.0.0.0-255.255.255.255). Classes A and B networks have 256 and 16times more possible IP addresses than a class C network. Taking the sizeproportion of class A, B and C networks, 256 class A network could beallocated as the following: (1) 240 to map 240 tenants with class Anetwork, (2) 15 to map 240 tenants with class B networks, and (3) asingle class A network to map 240 tenants with class C networks. Morespecifically, in some embodiments, the lowest range class A networks(starting with 0.x.x.x/24, 1.x.x.x/24 . . . up to 239.x.x.x/24) will beused to map addresses coming from the 10.x class A network to 240different target class A networks. The next 15 class A networks240.x.x.x/24 to 254.x.x.x/24, each will be used to include each 16 classB networks (e.g., for a total of 240 networks (15*16)). The last class Anetwork 255.x.x.x/24 will be used to include up to 256 private class Cnetworks. Even though 256 tenants can be fitted, only 240 are used and16 class C networks are not used. To summarize, some embodiments use thefollowing mapping:

-   -   10.x.x.x/24 networks→1.x.x.x/24-239.x.x.x/24, resulting in 240        different mapping for each tenant;    -   172.16-31.x.x/12 networks→240.x.x.x/24-254.x.x.x/24, resulting        in 240 different mapping for each tenant;    -   192.168.x.x/16→255.x.x.x/24 networks, resulting in 240 out of        256 possible mapping for each tenant.

The above-described schemes can support up to 240 tenants assuming thatit is not known ahead of time what type of network class the tenantswill use. In some embodiments, the public cloud network uses a privateIP address. In such a case, it is desirable not to map into the privateaddress space again. As some embodiments remove a class A network and aclass B network, there are only 239 different tenants that can besupported in these embodiments. To achieve a unique mapping, someembodiments number all tenants ID from 1 to 239, and then add to theleast significant 8 bits of the unmasked part of the private domain tothe tenant ID (expressed in 8 bits) modulo 240. In this case, for classA addresses, the first tenant (number 1) will be mapped to11.xx.xx.xx/24 and the last one (239) to 9.xx.xx.xx/24.

In the implementation illustrated in FIG. 16 , some embodiments provideto each TM engine 1605 any potential tenant ID subnets and a way toroute messages back to any specific IP address in each such subnet. Thisinformation can dynamically change when tenants, branches, and mobiledevices are added or removed. Hence, this information has to bedynamically distributed to the TM engines in the Internet egressgateways of the virtual network. The amount of information distributedand regularly updated can be large as the egress Internet gateways ofthe virtual network provider might be used by a large number of tenants.Also, the restriction of 240 (or 239) of tenant's ID is a global one andcan be solved only by adding multiple IPs addresses to the egresspoints.

FIG. 17 illustrates a double-NAT approach that is used in someembodiments instead of the single NAT approach illustrated in FIG. 16 .The approach illustrated in FIG. 17 requires less tenant data to bedistributed to most, if not all, TM engines and allows more privatetenant networks to be mapped to the internal network of the virtualnetwork provider. For a data message flow that traverses from a tenantmachine through the virtual network 1700 and then the Internet 1625 toanother machine (e.g., to a machine in a SaaS provider datacenter 1620),the approach illustrated in FIG. 17 places a NAT engine at the datamessage flow's ingress gateway 1770 into the virtual network and at thisflow's egress gateway 1702 or 1704 out of the virtual network and intothe Internet 1625. This approach also places the TM engines 1705 beforethe NAT engines 1712 of the ingress gateways 1770.

In the example illustrated in FIG. 17 , the message flows come from twobranch offices 1755 and 1760 and a datacenter 1765 of twovirtual-network tenants, and enter the virtual network 1700 through thesame ingress gateway 1770, although this does not necessarily have to bethe case. Like the virtual network 1600, the virtual network 1700 insome embodiments is defined over multiple public cloud datacenters ofmultiple public cloud vendors. Also, in some embodiments, thevirtual-network gateways 1702, 1704, and 1770 are part of the managedforwarding nodes, and the TM engines are placed in these embodimentsbefore the NAT engines 215 in these MFNs.

The TM engines 1605 and 1705 operate similarly in FIGS. 16 and 17 . LikeTM engines 1605, the TM engine 1705 maps the source IP and portaddresses of data messages entering the virtual network to new source IPand port addresses, when these data messages are destined to (i.e., havedestination IP addresses for) SaaS provider datacenters 1620. For eachsuch data message, the TM engine 1705 identifies the tenant ID andperforms its address mapping based on this identifier.

Like the TM engines 1605, the TM engine 1705 in some embodiments is astateless element and performs the mapping for each message through astatic table without looking at any dynamic data structure. As astateless element, the TM engine does not create a connection recordwhen it processes a first data message of a data message flow in orderto use this connection record in performing its address mapping forprocessing subsequent messages of the data message flow.

In doing its mapping, the TM engines 1705 in the ingress gateways 1770ensure that data message flows from different tenants that use the samesource IP and port addresses are mapped to unique non-overlappingaddress spaces. In some embodiments, the TM engine maps the source IPaddresses of different tenants into different IP ranges such that anytwo messages from different tenants will not be mapped to the same IPaddress. In other embodiments, the TM engine 1705 might map the sourceIP addresses of two different tenants to the same source IP range, butdifferent source port ranges. In still other embodiments, the TM enginemaps two tenants to different source IP ranges, while mapping two othertenants to the same source IP range but different source port ranges.

Unlike the TM engines 1605, the TM engines 1705 at the virtual-networkingress gateways only need to identify tenants for branch offices,corporate datacenters, and corporate compute nodes that are connected tothe ingress gateways. This significantly reduces the tenant data thatneeds to be initially supplied to, and periodically updated for, each TMengine. Also, as before, each TM engine can map only 239/240 tenants tounique address spaces. However, since the TM engines are placed at theingress gateways of virtual network provider, the TM engines can eachuniquely map 239/240 tenants.

The NAT engine 1712 of the ingress gateway 1770 in some embodiments canuse either external public IP addresses or internal IP addresses thatare specific to the public cloud (e.g. AWS, GCP or Azure) in which theingress gateway 1770 resides. In either case, the NAT engine 1712 mapsthe source network address of an incoming message (i.e., a messageentering the virtual network 1700) to an IP address that is uniquewithin its ingress gateway's private cloud network. In some embodiments,the NAT engine 1712 translates the source IP address of each tenant'sdata message flows to a different unique IP address. In otherembodiments, however, the NAT engine 1712 translates the source IPaddresses of different tenants' data message flows to the same IPaddress, but uses the source port addresses to differentiate the datamessage flows of the different tenants. In still other embodiments, theNAT engine maps the source IP addresses of two tenants to differentsource IP ranges, while mapping the source IP addresses of two othertenants to the same source IP range but different source port ranges.

In some embodiments, the NAT engine 1712 is a stateful element thatperforms its mapping by reference to a connection storage that storesconnection records that reflect its prior SNAT mappings. In someembodiments, the NAT engine can also use the connection storage in someembodiments when it receives a reply data message from the SaaS providermachine, in order to perform a DNAT operation to forward the reply datamessage to the tenant machine that sent the original message. The TM andNAT engines 1705, 1710 and 1712 are configured in some embodiments bythe controller cluster 160 (e.g., are provided with tables fordescribing the mapping to use for different tenants and different rangesof network address space).

FIG. 18 presents an example that illustrates the source port translationof the ingress NAT engine 1712. Specifically, it shows the sourceaddress mapping that the tenancy mapping engine 1705 and the ingress NATengine 1712 perform on a data message 1800 as it enters the virtualnetwork 1700 through an ingress gateway 1770 and as it exits the virtualnetwork at an egress gateway 1702. As shown, a tenant gateway 1810 sendsthe data message 1800, which arrives at the IPsec gateway 1805 with asource IP address of 10.1.1.13 and source port address of 4432. In someembodiments, these source addresses are addresses used by a tenantmachine (not shown), while in other embodiments, one or both of thesesource addresses are source addresses that are produced by a source NAToperation performed by the tenant gateway or another network element inthe tenant datacenter.

After this message has been processed by the IPsec gateway 1805, thisgateway or another module of the ingress MFN associates this messagewith the tenant ID of 15, which identifies the virtual-network tenant towhich the message 1800 belongs. Based on this tenant ID, the tenantmapping engine 1705 then maps the source IP and port addresses to sourceIP and port address pair of 15.1.1.13 and 253, as shown. This source IPand port addresses uniquely identify the message flow of the datamessage 1800. In some embodiments, the TM engine 1705 performs thismapping in a stateless manner (i.e., without reference to connectiontracking records). In other embodiments, the TM engine performs thismapping in a stateful manner.

The ingress NAT engine 1712 next translates (1) the source IP address ofthe data message 1800 to a unique private or public (internal orexternal) IP address of 198.15.4.33, and (2) the source port address ofthis message to port address 714. In some embodiments, the virtualnetwork uses this IP address for other data message flows of the same ordifferent tenants. Hence, in these embodiments, the source networkaddress translation (SNAT) operation of the NAT engine 1712 uses thesource port addresses to differentiate different message flows ofdifferent tenants that use the same IP address within the virtualnetwork.

In some embodiments, the source port address assigned by the ingress NATengine's SNAT operation is also the source port address that is used todifferentiate different message flows outside of the virtual network1700. This is the case in the example illustrated in FIG. 18 . As shown,the egress NAT engine 1710 in this example does not change the sourceport address of the data message when it performs its SNAT operation.Instead, it just changes the source IP address to an external IP address198.15.7.125, which in some embodiments is the public IP address of theegress gateway(s) of the virtual network. This public IP address in someembodiments is also an IP address of the public cloud datacenter inwhich the ingress and egress gateways 1770 and 1702 operate.

With the source IP and port addresses 198.15.7.125 and 714, the datamessage is routed through the Internet to reach a gateway 1815 of a SaaSprovider's datacenter. In this datacenter, a SaaS provider machineperforms an operation based on this message and sends back a replymessage 1900, the processing of which will be described below byreference to FIG. 19 . In some embodiments, the SaaS provider machineperforms one or more service operation (e.g., a middlebox serviceoperation, such as firewall operation, IDS operation, IPS operation,etc.) on the data message, based on one or more service rules that aredefined by reference to the source IP and port addresses 198.15.7.125and 714. In some of these embodiments, different service rules fordifferent tenants can specify the same source IP address (e.g.,198.15.7.125) in the rule identifiers while specifying different sourceport addresses in these rule identifiers. A rule identifier specifies aset of attributes for comparing to the data message flow attributeswhile performing a lookup operation that identifies a rule that matchesa data message.

FIG. 19 illustrates the processing of a reply message 1900 that a SaaSmachine (not shown) sends in response to its processing of the datamessage 1800. In some embodiments, the reply message 1900 can beidentical to the original data message 1800, it can be a modifiedversion of the original data message 1800, or it can be a completely newdata message. As shown, the SaaS gateway 1815 sends the message 1900based on the destination IP and port addresses 198.15.7.125 and 714,which are the source IP and port addresses of the data message 1800 whenthis message arrives at the SaaS gateway 1815.

The message 1900 is received at a gateway (not shown) of the virtualnetwork, and this gateway provides the data message to the NAT engine1710 that performed the last SNAT operation on the message 1800 beforethis message was sent to the SaaS provider. Although in the exampleillustrated in FIG. 19 , the data message 1900 is received at the sameNAT engine 1710 that performed the last SNAT operation, this does nothave to be the case in each deployment.

The NAT engine 1710 (now acting as an ingress NAT engine) performs aDNAT (destination NAT) operation on the data message 1900. Thisoperation changes the external destination IP address 198.15.7.125 to adestination IP address 198.15.4.33 that is used by the virtual networkto forward the data message 1900 through the public cloud routing fabricand between the virtual network components. Again, the IP address198.15.4.33 can be a public or private IP address in some embodiments.

As shown, the NAT engine 1712 (now acting as an egress NAT engine)receives the message 1900 after the NAT engine 1710 has translated itsdestination IP address. The NAT engine 1712 then performs a second DNAToperation on this message 1900, which replaces its destination IP andport addresses to 15.1.1.13 and 253. These addresses are the addressesrecognized by the TM engine 1705. The TM engine 1705 replaces theseaddresses to the destination IP and port addresses of 10.1.1.13 and4432, associates the data message 1900 with the tenant ID 15, andprovides the message 1900 with this tenant ID to the IPsec gateway 1805for forwarding to the tenant gateway 1810.

In some embodiments, a virtual network provider uses the above-describedprocesses, systems, and components to provide multiple virtual WANs formultiple different tenants (e.g., multiple different corporate WANs formultiple corporations) over multiple public clouds of the same ordifferent public cloud providers. FIG. 20 presents an example that showsM virtual corporate WANs 2015 for M tenants of a virtual networkprovider that has network infrastructure and controller cluster(s) 2010in N public clouds 2005 of one or more public cloud providers.

Each tenant's virtual WAN 2015 can span all of the N public clouds 2005,or a subset of these public clouds. Each tenant's virtual WAN 2015connects one or more branch offices 2020, datacenters 2025, SaaSprovider datacenters 2030, and remote devices of the tenant. In someembodiments, each tenant's virtual WAN spans any public cloud 2005 thatthe VNP's controller cluster deems necessary for efficiently forwardingdata messages between the different compute nodes 2020-2035 of thetenant. In selecting the public clouds, the controller cluster in someembodiments also accounts for public clouds that the tenant selectsand/or the public clouds in which the tenant, or at least one SaaSprovider of the tenant, has one or more machines.

The virtual WAN 2015 of each tenant allows the remote devices 2035(e.g., mobile devices or remote computers) of the tenant to avoidinteracting with the tenant's WAN gateway at any branch office or tenantdatacenter, in order to access a SaaS provider service (i.e., to accessa SaaS provider machine or machine cluster). The tenant's virtual WAN insome embodiments allows the remote devices to avoid the WAN gateways atthe branch offices and tenant datacenters, by moving the functionalitiesof these WAN gateways (e.g., the WAN security gateways) to one or moremachines in the public clouds spanned by the virtual WAN.

For example, to allow a remote device to access the compute resources ofthe tenant or its SaaS provider services, a WAN gateway in someembodiments has to enforce firewall rules that control how the remotedevice can access the tenant's computer resources or its SaaS providerservices. To avoid branch or datacenter WAN gateways of the tenant, thetenant's firewall engines 210 are placed in the virtual network MFNs inone or more public clouds spanned by the tenant's virtual WAN.

The firewall engines 210 in these MFNs perform the firewall serviceoperations on the data message flows from and to the remote devices. Byperforming these operations in the virtual network deployed over one ormore public clouds, the data message traffic associated with thetenant's remote devices do not need to be unnecessarily routed throughthe tenant's datacenter(s) or branch offices in order to receivefirewall rule processing. This alleviates traffic congestion in thetenant datacenters and branch offices, and avoids consuming expensiveingress/egress network bandwidth at these locations for processingtraffic that is not destined to compute resources at these locations. Italso helps speed up the forwarding of the data message traffic from andto the remote devices as this approach allows the intervening firewallrule processing to occur within the virtual network as the data messageflows traverse to their destinations (e.g., at their ingress MFNs,egress MFNs or intermediate-hop MFNs).

In some embodiments, the firewall enforcing engine 210 (e.g., firewallservice VM) of an MFN receives firewall rules form the VNP centralcontrollers 160. A firewall rule in some embodiments includes a ruleidentifier and an action. The rule identifier in some embodimentsincludes one or more match values that are to be compared to datamessage attributes, such as layer 2 attributes (e.g., MAC addresses),layer 3 attributes (e.g., five tuple identifiers, etc.), tenant ID,location ID (e.g., office location ID, datacenter ID, remote user ID,etc.), in order to determine whether the firewall rule matches a datamessage.

The firewall rule's action in some embodiments specifies the action(e.g., allow, drop, re-direct, etc.) that the firewall enforcing engine210 has to take on a data message when the firewall rule matches thedata message's attributes. To address the possibility that multiplefirewall rules match a data message, the firewall enforcing engine 210stores the firewall rules (that it receives from the controller cluster160) in a firewall rule data storage in a hierarchical manner so thatone firewall rule can have higher priority than another firewall rule.When a data message matches two firewall rules, the firewall enforcingengine applies the rule with the higher priority in some embodiments. Inother embodiments, the firewall enforcing engine examines the firewallrules according to their hierarchy (i.e., examines higher priority rulesbefore lower priority rules) in order to ensure that it first matchesthe higher priority rule in case another lower priority rule might alsobe a match for the data message.

Some embodiments allow the controller cluster to configure the MFNcomponents to have the firewall service engines examine a data messageat an ingress node (e.g., node 850) as it enters a virtual network, atan intermediate node (e.g., node 857) on the virtual network or at anegress node (e.g., node 855) as it exits the virtual network. At each ofthese nodes, the CFE (e.g., 832, 856, or 858) in some embodiments callsits associated firewall service engine 210 to perform the firewallservice operation on the data message that the CFE receives. In someembodiments, the firewall service engine returns its decision to themodule that called it (e.g., to the CFE) so that this module can performthe firewall action on the data message, while in other embodiments, thefirewall service engine performs its firewall action on the datamessage.

In some embodiments, other MFN components direct the firewall serviceengine to perform its operation. For instance, at an ingress node, theVPN gateway (e.g., 225 or 230) in some embodiments directs itsassociated firewall service engine to perform its operation, in order todetermine whether the data message should be passed to the ingressnode's CFE. Also, at the egress node, the CFE in some embodiments passesthe data message to its associated firewall service engine, which if itdecides to allow the data message through, then passes the data messagethrough an external network (e.g., the Internet) to its destination, orpasses the data message to its associated NAT engine 215 to perform itsNAT operation before passing the data message to its destination throughan external network.

The virtual network providers of some embodiments allow the tenant's WANsecurity gateway that is defined in the public clouds to implement othersecurity services in addition to, or instead of, firewall services. Forinstance, a tenant's distributed WAN security gateway (which in someembodiments is distributed over each public cloud datacenter that isspanned by the tenant's virtual network) not only includes firewallservice engines, but also includes intrusion detection engines andintrusion prevention engines. In some embodiments, the intrusiondetection engines and intrusion prevention engines are incorporatedarchitecturally in the MFN 150 to occupy similar position to thefirewall service engine 210.

Each of these engines in some embodiments includes one or more storagesthat store intrusion detection/prevention policies distributed by thecentral controller cluster 160. In some embodiments, these policiesconfigure the engines to detect/prevent unauthorized intrusions into thetenant's virtual network (that is deployed over several public clouddatacenters), and to take actions in response to detected intrusionevents (e.g., generating logs, sending out notifications, shutting downservices or machines, etc.). Like firewall rules, the intrusiondetection/prevention policies can be enforced at various differentmanaged forwarding nodes (e.g., ingress MFNs, intermediate MFNs, and/oregress MFNs of the data message flows) over which the virtual network isdefined.

As mentioned above, the virtual network provider deploys each tenant'svirtual WAN by deploying at least one MFN in each public cloud spannedby the virtual WAN, and configuring the deployed MFNs to define routesbetween the MFNs that allow the tenant's message flows to enter and exitthe virtual WAN. Also, as mentioned above, each MFN can be shared bydifferent tenants in some embodiments, while in other embodiments eachMFN is deployed for just one particular tenant.

In some embodiments, each tenant's virtual WAN is a secure virtual WANthat is established by connecting the MFNs used by that WAN throughoverlay tunnels. This overlay tunnel approach in some embodimentsencapsulates each tenant's data message flows with a tunnel header thatis unique to each tenant, e.g., contains a tenant identifier thatuniquely identifies the tenant. For a tenant, the virtual networkprovider's CFEs in some embodiments use one tunnel header to identifyingress/egress forwarding elements for entering/exiting the tenant'svirtual WAN, and another tunnel header to traverse interveningforwarding elements of the virtual network. The virtual WAN's CFEs usedifferent overlay encapsulation mechanisms in other embodiments.

To deploy a virtual WAN for a tenant over one or more public clouds, theVNP's controller cluster (1) identifies possible edge MFNs (that canserve as ingress or egress MFNs for different data message flows) forthe tenant based on locations of the tenant's corporate compute nodes(e.g., branch offices, datacenters, mobile users, and SaaS providers),and (2) identifies routes between all possible edge MFNs. Once theseroutes are identified they are propagated to the forwarding tables ofthe CFEs (e.g., propagated using OpenFlow to different OVS-based virtualnetwork routers). Specifically, to identify optimal routes through atenant's virtual WAN, the MFNs associated with this WAN generatemeasurement values that quantify the quality of the network connectionbetween them and their neighboring MFNs, and regularly provide theirmeasurements to the VNP's controller cluster.

As mentioned above, the controller cluster then aggregates themeasurements from the different MFNs, generates routing graphs based onthese measurements, defines routes through a tenant's virtual WAN, andthen distributes these routes to the forwarding elements of the CFEs ofthe MFNs. To dynamically update the defined routes for a tenant'svirtual WAN, the MFNs associated with this WAN periodically generatetheir measurements and provide these measurements to the controllercluster, which then periodically repeats its measurement aggregation,route-graph generation, route identification, and route distributionbased on the updated measurements that it receives.

In defining the routes through a tenant's virtual WAN, the VNP'scontroller cluster optimizes the routes for the desired end-to-endperformance, reliability and security, while trying to minimize therouting of tenant's message flows through the Internet. The controllercluster also configures the MFN components to optimize the layer 4processing of the data message flows passing through the network (e.g.,to optimize the end-to-end rate of TCP connections by splitting the ratecontrol mechanisms across the connection path).

With the proliferation of public clouds, it is often very easy to find amajor public cloud datacenter close to each branch office of acorporation. Similarly, SaaS vendors are increasingly hosting theirapplications within public clouds, or are similarly located at thevicinity of some public cloud datacenter. Consequently, the virtualcorporate WANs 2015 securely use the public clouds 2005 as corporatenetwork infrastructure that have presence in the vicinity of thecorporate compute nodes (e.g., branch offices, datacenters, remotedevices, and SaaS providers).

Corporate WANs require bandwidth guarantees in order to provide businesscritical application at an acceptable performance at all times. Suchapplications may be interactive data applications, e.g. ERP, financialor procurement, deadline-oriented application (e.g., industrial or IoTcontrol), real time application (e.g., VoIP or video conferencing).Consequently, traditional WAN infrastructure (e.g., Frame Relay or MPLS)provides such guarantees.

A main obstacle in providing bandwidth guarantee in a multi-tenantnetwork is the need to reserve bandwidth over one or more path for acertain customer. In some embodiments, the VNP offers QoS services andprovides an Ingress Committed Rate (ICR) guarantee and an EgressCommitted Rate (ECR) guarantee. ICR refers to the traffic rate cominginto the virtual network, while ECR refers to the traffic rate exitingthe virtual network to the tenant site.

As long as traffic does not exceed ICR and ECR limits, the virtualnetwork in some embodiments provides bandwidth and delay guarantees. Forexample, as long as HTTP ingress or egress traffic do not exceed 1 Mbps,the bandwidth and low delay are guaranteed. This is the point-to-cloudmodel because, for QoS purposes, the VNP need not keep track of trafficdestinations, as long as its destinations are within the ICR/ECR bounds.This model is sometimes called the hose model.

For the more stringent applications, where a customer desires apoint-to-point guarantee, a virtual data pipe needs to be constructed todeliver the highly critical traffic. For example, an enterprise may wanttwo hub sites or datacenters connected with high service level agreementguarantees. To that end, VNP routing automatically chooses a routingpath that satisfies the bandwidth constraint for each customer. This isreferred to as the point-to-point model or the pipe model.

The main advantage of VNP in providing guaranteed bandwidth to end usersis the ability to adjust the VNP infrastructure according to thechanging bandwidth demands. Most public clouds provide minimum bandwidthguarantees between each two instances located at different regions ofthe same cloud. If the current network does not have enough unusedcapacity to provide the guaranteed bandwidth for a new request, the VNPadds new resources to its facilities. For example, the VNP can add newCFEs in high-demand regions.

One challenge is to optimize the performance and the cost of this newdimension in planning routes and scaling up and down the infrastructure.To facilitate the algorithms and bandwidth accounting, some embodimentsassume that end-to-end bandwidth reservations are not split. In otherways, if a certain bandwidth (e.g., 10 Mbps) is reserved between branchA and branch B of a certain tenant, the bandwidth is allocated over asingle path that starts from an ingress CFE to which branch A connects,and then traverses a set of zero or more intermediate CFEs to reach theegress CFE that is connected to branch B. Some embodiments also assumethat the bandwidth guaranteed path only traverse a single public cloud.

In order to account for the various bandwidth reservation that intersectover the network topology, the VNP in some embodiments defines therouting over a reserved bandwidth path statically, so that data messageflows always traverse through the same routes that were reserved for thebandwidth requirements. In some embodiments, each route is identifiedwith a single tag that each CFE traversed by the route matches to asingle outgoing interface associated with this route. Specifically, eachCFE matches a single outgoing interface to each data message that hasthis tag in its header and arrives from a specific incoming interface.

In some embodiments, the controller cluster maintains a network graphthat is formed by several interconnected nodes. Each node n in the graphhas the allocated total guaranteed bandwidth (TBW_(n)) associated withthis node and the amount of bandwidth already reserved (allocated to acertain reserved path) by this node (RBW_(n)). In addition, for eachnode, the graph includes the cost in cents per gigabyte (C_(ij)) and thedelay in milliseconds (D_(ij)) associated with sending traffic betweenthis node and all other nodes in the graph. The weight associated withsending traffic between node i and node j is W_(ij)=a*C_(ij)+D_(ij),where a is a system parameter that is typically between 1 and 10.

When a request for a bandwidth reservation of value BW between branchesA and B is accepted, the controller cluster first maps the request tospecific ingress and egress routers n and m, which are bound to branchesA and B respectively. The controller cluster then executes a routingprocess that conducts two lowest-cost (e.g., shortest path) computationsbetween n and m. The first is a lowest-cost (e.g., shortest path) routebetween n and m irrespective of the available bandwidth along thecomputed route. The total weight of this route is computed as W₁.

The second lowest-cost (e.g., shortest path) computation initiallymodifies the graph by eliminating all nodes i where BW>TBW_(i)−RBW_(i).The modified graph is termed the trimmed graph. The controller clusterthen performs a second lowest-cost (e.g., shortest path) routecomputation over the trimmed graph. If the weight of the second route isno more than K percent (K is typically 10%-30%) higher than the firstroute, the second route is selected as the preferred path. On the otherhand, when this requirement is not met, the controller cluster will addto the first path the node i with the smallest value of TBW_(i)-RBW_(i),and then repeats the two lowest-cost (e.g., shortest path) computations.The controller cluster will continue adding more routers until thecondition is met. At that point, the reserved bandwidth BW is added toall RBW_(i) where i is a router on the selected route.

For the special case of a request for additional bandwidth for a routethat already has reserved bandwidth, the controller cluster will firstdelete the current bandwidth reservation between nodes A and B and willcalculate the path for the total bandwidth request between these nodes.To do this, the information held for each node in some embodiments alsoincludes the bandwidth reserved for each tag, or each source anddestination branches, and not only the overall bandwidth reserved. Afterbandwidth reservations are added to the network, some embodiments do notrevisit the routes so long as there are no major changes in measurednetwork delays or costs through the virtual network. However, when themeasurements and/or costs change, these embodiments repeat the bandwidthreservation and route computation processes.

FIG. 21 conceptually illustrates a process 2100 performed by thecontroller cluster 160 of the virtual network provider to deploy andmanage a virtual WAN for a particular tenant. In some embodiments, theprocess 2100 is performed by several different controller programsexecuting on the controller cluster 160. The operations of this processdo not necessarily have to follow the sequence illustrated in FIG. 21 ,as these operations can be performed by the different programs inparallel or in a different sequence. Accordingly, these operations areillustrated in this figure only to describe one exemplary sequence ofoperations performed by the controller cluster.

As shown, the controller cluster initially deploys (at 2105) severalMFNs in several public cloud datacenters of several different publiccloud providers (e.g., Amazon AWS, Google GCP, etc.). The controllercluster in some embodiments configures (at 2105) these deployed MFNs forone or more other tenants that are different than the particular tenantfor which the process 2100 is illustrated.

At 2110, the controller cluster receives from the particular tenant dataabout external machine attributes and locations of the particulartenant. In some embodiments, this data includes the private subnets usedby the particular tenant as well as identifiers for one or more tenantoffices and datacenters at which the particular tenant has externalmachines. In some embodiments, the controller cluster can receive thetenant data through APIs or through a user interface that the controllercluster provides.

Next, at 2115, the controller cluster generates a routing graph for theparticular tenant from the measurements collected by the measurementagents 205 of the MFNs 150 that are candidate MFNs to use forestablishing the virtual network for the particular tenant. As mentionedabove, the routing graph has nodes that represent the MFNs, and linksbetween the nodes that represent the network connections between theMFNs. The links have associated weights, which are cost values thatquantify the quality and/or cost of using the network connectionsrepresented by the links. As mentioned above, the controller clusterfirst generates a measurement graph from the collected measurements, andthen generates the routing graph by removing links from the measurementgraph that are not optimal (e.g., that have large delays or drop rates).

After constructing the routing graph, the controller cluster performs(at 2120) path searches to identify possible routes between differentpairs of candidate ingress and egress nodes (i.e., MFNs) that thetenant's external machines can use to send data messages into thevirtual network (deployed by the MFNs) and to receive data messages fromthe virtual network. In some embodiments, the controller cluster usesknown path search algorithms to identify different paths between eachcandidate ingress/egress pair of nodes. Each path for such a pair usesone or more links that when concatenated traverse from the ingress nodeto the egress node through zero or more intermediate nodes.

In some embodiments, the cost between any two MFNs comprises a weightedsum of estimated latency and financial costs for a connection linkbetween the two MFNs. The latency and financial costs include in someembodiments one or more of the following: (1) link delay measurements,(2) estimated message processing latency, (3) cloud charges for outgoingtraffic from a particular datacenter either to another datacenter of thesame public cloud provider, or to exit the public cloud (PC) provider'scloud (e.g., to another public cloud datacenter of another public cloudprovider or to the Internet), and (4) estimated message processing costsassociated with the MFNs executing on host computers in the publicclouds.

Some embodiments assess a penalty for connection links between two MFNsthat traverse through the public Internet, in order to minimize suchtraversal whenever possible. Some embodiments also incentivize the useof private network connections between two datacenters (e.g., byreducing the connection link cost) in order to bias the route generationtowards using such connections. Using the computed costs of thesepair-wise links, the controller cluster can compute the cost of eachrouting path that uses one or more of these pair-wise links byaggregating the costs of the individual pair-wise links that are used bythe routing path.

The controller cluster then selects (at 2120) one or up to N identifiedpaths (where N is an integer larger than 1) based on the computed costs(e.g., the lowest aggregate cost) of the identified candidate pathsbetween each candidate ingress/egress pair of nodes. In someembodiments, the computed costs for each path are based on the weightcost of each link used by the path (e.g., is a sum of each link'sassociated weight value), as mentioned above. The controller cluster canselect more than one path between a pair of ingress/egress nodes whenmore than one route is needed between two MFNs to allow the ingress MFNor an intermediate MFN to perform a multi-path operation.

After selecting (at 2120) one or N paths for each candidate pair ofingress/egress nodes, the controller cluster defines one or N routesbased on the selected paths, and then generates route tables or routetable portions for the MFNs that implement the particular tenant'svirtual network. The generated route records identify edge MFNs to reachdifferent subnets of the particular tenant, and identify next hop MFNsfor traversing routes from ingress MFNs to egress MFNs.

At 2125, the controller cluster distributes route records to the MFNs inorder to configure the forwarding elements 235 of these MFNs toimplement the virtual network for the particular tenant. In someembodiments, the controller cluster communicates with the forwardingelements to pass the route records by using communication protocols thatare presently used in a software defined multi-tenant datacenter toconfigure software routers executing on host computers to implement alogical network that spans the host computers.

Once the MFNs have been configured and the virtual network isoperational for the particular tenant, the edge MFNs receive datamessages from tenant's external machines (i.e., machines outside of thevirtual network) and forward these data messages to edge MFNs in thevirtual network, which in turn forward the data messages to otherexternal machines of the tenant. While performing such forwardingoperations, the ingress, intermediate and egress MFNs collect statisticsregarding their forwarding operations. Also, in some embodiments, one ormore modules on each MFN in some embodiments collect other statisticsregarding network or compute consumption in the public clouddatacenters. In some embodiments, the public cloud providers collectsuch consumption data and pass the collected data to the virtual networkprovider.

When approaching a billing cycle, the controller cluster collects (e.g.,at 2130) statistics collected by the MFNs, and/or the network/computeconsumption data collected by the MFNs or provided by the public cloudproviders. Based on the collected statistics, and/or provided thenetwork/compute consumption data, the controller cluster generates (at2130) billing reports and sends the billing reports to the particulartenant.

As mentioned above, the amount billed in the billing report accounts forstatistics and network/consumption data that the controller clusterreceives (e.g., at 2130). Also, in some embodiments, the bill accountsfor the cost that the virtual network provider incurred to operate theMFNs (that implement the virtual network for the particular tenant) plusa rate of return (e.g., a 10% increase). This billing scheme isconvenient for the particular tenant because the particular tenant doesnot have to deal with bills from multiple different public cloudproviders over which the tenant's virtual network is deployed. The VNP'sincurred cost in some embodiments includes the cost charged to the VNPby the public cloud providers. At 2130, the controller cluster alsocharges a credit card or electronically withdraws funds from a bankaccount for the charges reflected in the billing report.

At 2135, the controller cluster determines whether it has received newmeasurements from the measurement agents 205. If not, the processtransitions to 2145, which will be described below. On the other hand,when the controller cluster determines that it has received newmeasurements from the measurement agents, it determines (at 2140)whether it needs to re-examine its routing graph for the particulartenant based on the new measurements. Absent an MFN failure, thecontroller cluster in some embodiments at most updates its routing graphfor each tenant once during a particular time period (e.g., once every24 hours or every week) based on received, updated measurements.

When the controller cluster determines (at 2140) that it needs tore-examine the routing graph based on new measurements that it hasreceived, the process generates (at 2145) a new measurement graph basedon the newly received measurements. In some embodiments, the controllercluster uses a weighted sum to blend each new measurement with the priormeasurements in order to ensure that the measurement values associatedwith the links of the measurement graph do not fluctuate dramaticallyeach time a new measurement set is received.

At 2145, the controller cluster also determines whether it needs toadjust the routing graph based on the adjusted measurement graph (e.g.,whether it needs to adjust weight values for the routing-graph links, oradd or remove links in the routing graph because of adjusted measurementvalues associated with the links). If so, the controller cluster (at2145) adjusts the routing graph, performs path search operations (suchas operations 2120) to identify routes between ingress/egress nodepairs, generates route records based on the identified routes, anddistributes route records to the MFNs. From 2145, the processtransitions to 2150.

The process also transitions to 2150 when the controller clusterdetermines (at 2140) that it does not need to re-examine the routinggraph. At 2150, the controller cluster determines whether it has tocollect statistics regarding data messages processed and network/computeresources consumed. If not, the process returns to 2135 to determinewhether it has received new measurements from the MFN measurementagents. Otherwise, the process returns to 2130 to collect statistics andnetwork/compute consumption data, and to generate and send billingreports. In some embodiments, the controller cluster repeatedly performsthe operations of the process 2100 until the particular tenant no longerneeds a virtual network that is deployed across the public clouddatacenters.

In some embodiments, the controller cluster not only deploys virtualnetworks for tenants in the public cloud datacenters, but also assiststhe tenants in deploying and configuring compute node machines andservice machines in the public cloud datacenters. The deployed servicemachines can be machines separate from the service machines of the MFNs.In some embodiments, the controller cluster billing report to theparticular tenant also accounts for compute resources consumed by thedeployed compute and service machines. Again, having one bill from onevirtual network provider for network and compute resources consumed inmultiple public cloud datacenters of multiple public cloud providers ismore preferable for the tenant than receiving multiple bills frommultiple public cloud providers.

Other embodiments use other deployment models to deploy single ormulti-tenant virtual networks over the network and computeinfrastructure of two or more public cloud providers. For instance, insome embodiments, the virtual network provider allows one or more cloudservice resellers to deploy single or multi-tenant virtual networks forone or more of their customers. FIG. 22 illustrates this deploymentmodel. As shown, this deployment model uses three levels of SaaSproviders 2205-2215 that provide three sets of SaaS services.

The first SaaS layer 2205 is provided by one or more public cloudproviders 2220 that provide compute and network infrastructure (e.g.,compute elements (such as host computers, VMs and/or containers) andnetwork elements (hardware or software switches, routers, middleboxelements, etc.) that connect the compute elements) in multiple differentpublic clouds 2250. The second SaaS layer 2210 is provided by the VNP2225, which provides the tools for deploying virtual networks acrossmultiple public clouds 2250 for a cloud reseller. The cloud reseller2230 provides the third SaaS layer 2215 to its customers 2240, which usethe cloud resellers tools to define compute elements and networkinfrastructure (e.g., virtual network) to deploy across one or morepublic clouds 2250.

The cloud reseller 2230 in some embodiments has its own customer accountwith each of the public cloud providers. In some embodiments, the cloudreseller establishes its customer account with each public cloudprovider directly (as identified by dashed arc 2252) and then providessecurity credentials for this customer account to the VNP provider 2225.In other embodiments, the cloud reseller establishes its public cloudcustomer account through the VNP provider's machines 2225. To direct theVNP to deploy a virtual network for one of its tenants over public cloudinfrastructure, the cloud reseller machines 2230 initially provide thecloud reseller's VNP security credentials (e.g., username, password,certificate, etc.) to the VNP machines 2225 in order to authenticate thecloud reseller.

As shown, the cloud reseller also provides the desired networkconfiguration to the VNP 2225. This configuration described theattributes of the virtual network that needs to be deployed for atenant. In some embodiments, this configuration data also includes atenant identifier that the cloud reseller 2230 uses for its customer forwhich it directs the VNP 2225 to deploy a virtual network. This tenantidentifier in some embodiments is obtained from the VNP. In otherembodiments, the configuration data includes a tenant identifierprovided by the VNP, which the cloud reseller maps to its own tenantidentifier for its tenant.

In some embodiments, the VNP machines 2225 provide the cloud reseller'ssecurity credentials to the public cloud machines 2220 when deployingvirtual networks (e.g., when deploying MFNs, configuring MFN CFEs withproper routing records, etc.) for the reseller's customers. Thesesecurity credentials (e.g., user name, password, security certificate,etc.) allow the VNP machines to authenticate themselves as machinesoperating at the behest of the cloud reseller (e.g., to logon onto thepublic cloud machines 2220 as if the cloud reseller machines 2230 arelogging on to the public cloud machines 2220).

To deploy the virtual network for each tenant of the cloud reseller, theVNP machines also configure in some embodiments the components that formthe virtual network (e.g., the MFN, MFN gateways/service boxes/CFEs,etc.) with the tenant identifier for the cloud reseller's tenant. Insome embodiments, these configured components then associate thestatistics that they collect (e.g., the routing statistics anddeployment machine compute statistics) with the tenant identifiers, sothat the cloud reseller's customers can be appropriately charged basedon these statistics, as further described below.

In some of the embodiments in which the cloud reseller provides thetenant identifiers for its customers to the VNP machines 2225, the VNPmachines 2225 map each tenant identifier provided by the cloud reseller2230 to a unique tenant identifier of the VNP, and translate the VNPtenant identifiers for the collected statistics to the cloud reseller'stenant identifiers before providing the statistics to the cloudreseller. In other embodiments, the cloud reseller machines 2230 and/orVNP provider machines 2225 use tenant identifiers provided by the publiccloud provider machines 2220.

The VNP machines 2225 uses the tenant network configuration dataprovided by the cloud reseller 2230 to deploy and/or configure thevirtual network components (e.g., the MFNs, etc.) of the virtual networkfor each customer of the cloud reseller. In some embodiments, multipledifferent customers share the same virtual network and/or virtualnetwork components. Conjunctively, or alternatively, the VNP machines2225 in some embodiments can define single tenant virtual networks forany individual customer of the cloud reseller. As shown, the VNPmachines 2225 deploy and configure the virtual networks and/or virtualnetwork components through the public cloud provider machines 2220. Insome embodiments, reseller, VNP, and public cloud machines 2220-2230communicate with each other through their respective API interfaces andintervening network fabric (e.g., the Internet).

The VNP machines 2225 collect per tenant statistics from the deploymentvirtual network components (e.g., routing statistics from the CFEs andgateways, etc.), aggregate the statistics, and forward the aggregatedstatistics to the cloud reseller. In the embodiments in which the VNPmachines map the reseller customer identifiers to VNP tenantidentifiers, the VNP machines translate the tenant identifiers to thecustomer identifiers before supplying the aggregated statistics with thetranslated customer identifiers. Also, in the embodiments in which theVNP machines map the public cloud identifiers to VNP tenant identifiers,the VNP machines translate the public cloud identifiers to the VNPidentifiers.

As shown, the VNP machines 2225 periodically send billing reports to thecloud reseller 2230 to collect fees for services performed by the VNP.In some embodiments, these billing reports charge the cloud reseller forthe VNP's service fees for deploying virtual networks for the cloudreseller over two or more public clouds. These deployment chargesinclude fees for performing ancillary operations in support of suchdeployments, such as measurement operations that produce measurementsthat quantify the quality and/or cost of links between MFNs in thepublic clouds and between external machine locations of the tenants.

Also, the VNP machines 2225 in some embodiments receive billing datafrom one or more public cloud providers for the cloud reseller. Thisbilling data is associated with the cloud reseller's customercredentials (e.g., PC provider customer number for the cloud reseller)in some embodiments. The VNP machines 2225 in these embodiments passalong the billing data to the cloud reseller (e.g., with a markupadjustment or without a markup adjustment). In other embodiments, thepublic cloud providers send billing reports directly to the cloudreseller machines 2230, as shown by dashed lines 2252.

The cloud reseller machines 2230 in some embodiments uses the usagestatistics provided by the VNP machines 2225 to charge its customers forthe virtual networks. In some embodiments, the VNP machines 2225 notonly deploy network infrastructure but also deploy computeinfrastructure for the cloud reseller 2230. In some of theseembodiments, the usage statistics reflects the used compute resourcesand the cloud reseller machines 2230 use these statistics to charge thereseller's customers. In some embodiments, the cloud reseller does notuse the collected statistics to charge its customers, but rather chargesits customers based on the compute and/or network configuration that thecustomer requested for deployment.

To further illustrate the differences between the three-layer SaaSdeployment model of FIG. 22 , FIG. 23 illustrates a similar diagram forthe two-layer SaaS deployment model that was previously described above.This two-layer model of FIG. 23 does not have any cloud reseller 2215.Rather, in this two-layer model, the VNP's customers are entities thathave the VNP deploy a single-tenant virtual network just for them, or toshare a multi-tenant virtual network that the VNP has deployed forseveral customers. As described above, different customers can securelyshare the components the define the multi-tenant virtual network overone or more public clouds, as each customers network traffic is securelysegregated from the network traffic of other customers.

In the two-layer model of FIG. 23 , the first SaaS layer 2205 isprovided by one or more public cloud providers 2220 that provide computeand network infrastructure in multiple different public clouds 2250,while the second SaaS layer 2210 is provided by the VNP 2225, whichprovides the tools for deploying virtual networks across multiple publicclouds 2250 for several of its customers. As shown, the VNP machines2225 provide to the public cloud providers the VNP security credentialsfor the public clouds.

The VNP machines receive for each customer (associated with a tenantidentifier) tenant network configuration data, and based on this data,deploy and/or configure the virtual network components (e.g., the MFNs,etc.) of the virtual network for each of its customers. As shown, theVNP machines 2225 deploy and configure the virtual networks and/orvirtual network components through the public cloud provider machines2220. In some embodiments, VNP and and public cloud machines 2220 and2225 communicate with each other through their respective API interfacesand intervening network fabric (e.g., the Internet).

As further shown, the VNP machines 2225 collect per tenant statisticsfrom the deployment virtual network components (e.g., routing statisticsfrom the CFEs and gateways, etc.), and aggregate the collectedstatistics. The VNP machines 2225 periodically send billing reports toeach of the VNP customers to collect fees for services performed by theVNP. As mentioned above, these fees in some embodiments include the feesthat the public cloud providers charged the VNP for the resources (e.g.,compute and/or network resources) consumed by the customer's virtualnetwork, plus a certain markup percentage. The VNP machines identify theamount of resources by each customer's virtual network based on thestatistics that these machines collect and aggregate for the customer'sassociated identifier. In other embodiments, the VNP machines passthrough to each customer each public cloud provider's charge for theresources consumed by the customer's virtual network, plus a charge foreach customer's use of VNP resources.

Some embodiments connect a multi-machine compute node (e.g., a branchoffice or datacenter) of a tenant to the tenant's public cloud virtualnetwork through multiple connection links to multiple public clouds(e.g., multiple public cloud datacenters) of one or more public cloudproviders. Having multiple links between the multi-machine compute node(MMCN) and the public cloud virtual network allows the virtual networkto be highly available, as it can withstand the failure of one or moreconnection links. In some embodiments, one link is a primary link whileeach other link is a failover link. This approach also allows the bestroute to be established from each MMCN to each other MMCN or SaaSprovider datacenter by selecting the best ingress node for entering thevirtual network from the MMCN for the best routing path through thevirtual network to the egress node for exiting the virtual network toanother MMCN or SaaS provider datacenter.

The discussion below uses the term multi-homed MMCN to refer to amulti-machine compute node of a tenant that connects to the tenant'spublic cloud virtual network through multiple connection links tomultiple public clouds of one or more public cloud providers. Thediscussion below also uses the term multi-homed SaaS datacenter to referto a SaaS datacenter to which a virtual network associates multiple MFNsin one or more public clouds (e.g., multiple public cloud datacenters)of one or more public cloud providers. These MFNs in some embodimentsare candidate egress nodes for routes that traverse through the virtualnetwork to reach a SaaS provider. The use of two or more egress nodes toconnect the virtual network of a SaaS datacenter is also advantageous inthat it enables link failover support and it allows for the use ofoptimal routes between different pairs of external computer node (e.g.,remote computer or MMCN) and SaaS provider datacenter.

In some embodiments, a SaaS datacenter does not need to initiate routesto multiple MFNs of the virtual network in multiple public clouddatacenters, even when the virtual network controllers 160 associatemultiple MFNs with the SaaS datacenter. On the other hand, multi-homedMMCNs in some embodiments need to actively initiate routes throughdifferent links to the virtual network. To do this, providing a fallbackcapability is facilitated in a multi-homed MMCN by having an appropriaterouter with failover capabilities (e.g., by using a Cisco 2800 series).

For optimal routing, the multi-homed MMCN includes in some embodimentsone or more computers or appliances that execute measurement processesto measure the performance (delay, loss etc.) between the MMCN and thedifferent public cloud datacenters to which the MMCN can connect. Inaddition, the MMCN in some embodiments performs its overall routingoperations based on routes that are defined by the centralizedcontroller cluster (e.g., controller cluster 160) that defines thevirtual network for an entity (e.g., for a tenant). To accomplish this,the multi-homed MMCN is equipped with SD-WAN capabilities (such asVelocloud and Viptela appliances) that operate as a part of thecentralized control plane for deploying the virtual network. Asmentioned above, the centralized control plane is implemented by acluster of two or more controllers in some embodiments.

FIG. 24 illustrates a process 2400 used by the central controllercluster of some embodiments to define routes for a particularmulti-homed MMCN. This process uses a specialized router in theparticular multi-homed MMCN to use the defined routes to perform routingoperations that forward data messages from the MMCN to the virtualnetwork through the multiple connection links. The specialized router isa software router or a cluster of software routers in some embodiment,while it is a routing appliance (e.g., SD-WAN appliance) in otherembodiments. The specialized router or router cluster in the MMCN isreferred to as the edge node of the MMCN in the discussion below. Insome embodiments, the central controller cluster remotely controls theedge nodes of the MMCNs through the Internet.

As shown, the central controller cluster initially identifies (at 2405)a subset of N MFNs (e.g., 10 to 12) from N different cloud regions thatare the closest to the particular MMCN edge node according to a DNSserver service and the edge node IP address. The N MFNs in someembodiments have at least one candidate MFN from each cloud providerwithin a certain distance of the particular MMCN. Also, in someembodiments, each of the N MFNs includes a gateway (e.g., a branchgateway 225) to establish a secure connection link with the particularMMCN edge node.

Also, as mentioned above, the DNS server service in some embodiments isa service machine, or a cluster of several service machines, thatoperates in one or more public clouds and that provides DNS informationto DNS servers of the MMCNs of an entity. In some of these embodiments,the DNS servers are operated by the virtual network provider or byanother entity. In other embodiments, the DNS server service is a geo-IPservice (e.g., of a third party) that resides outside of the publicclouds that implement the virtual network and that can identify edgenodes in the public clouds that are near the particular MMCN for whichthe process 2400 is performed.

Next, at 2410, the controller cluster downloads the identified list to Nnodes to the particular MMCN's edge node so that the MMCN's edge nodecan take measurements that quantify the quality of connections to eachof the N MFNs in the list. In some embodiments, each MMCN edge node hasa measurement agent (e.g., a process executing on one of the MMCNcomputers) that generates such measurements. This measurement agentgenerates measurement values differently in different embodiments. Insome embodiments, the measurement agent sends pinging messages (e.g.,UDP echo messages) periodically (e.g., once every second, every Nseconds, every minute, every M minutes, etc.) to each of the measurementagents of the N MFNs in the list. Based on the speed of the replymessages that it receives, the MMCN measurement agent computes andupdates measurement metric values, such as network-connection throughputspeed, delay, loss, and link reliability. In some embodiments, multipleMFNs share one measurement agent (e.g., in the same datacenter or nearbydatacenter of the public cloud provider hosting the MFNs).

In some embodiments, the particular MMCN's measurement agentperiodically performs these measurements, and periodically sends the newmeasurements to the controller cluster so that the controller clustercan update its weight computations and route generations, as furtherdescribed below by reference to 2420-2435. Also, whenever new MFNs areadded in newly added or previously used public cloud datacenters, thecontroller cluster in some embodiments generates update lists of Ncandidate MFNs.

At 2415, the controller cluster receives the measurements taken by theparticular MMCN's edge node. Based on these measurements, thecentralized controller cluster computes (at 2420) a link weight for eachconnection link that connects the particular MMCN's edge node to each ofthe N MFNs. For instance, in some embodiments, the central controllercomputes each link's weight by using an exponential filter on the delaymeasurements and using the loss parameter as weight multiplier (e.g.,doubling the weight for each 1% of loss).

Based on the computed weights, the central controller then identifies(at 2425) a subset of the M (e.g., 5 or 6) MFNs as the “home” nodes towhich the edge node will be connected. In some embodiments, the M nodesare the nodes with the lowest weight values. In other embodiments, the Mnodes are the nodes with the lowest weight values, but at least onerepresentative MFN in each cloud provider is included in the M nodes.The list of M nodes may change with time and MFNs can be dropped andadded to the list as new MFNs are added and/or as new measurements arereceived from the particular MMCN edge node. The controller cluster insome embodiments uses a “hysteresis” process to avoid frequent changesin the list of M MFNs. The hysteresis process in some embodiments usesprevious state (i.e., previous members) of the MFN list to reduce therate of adding/removing members to/from the MFN list. Also, in someembodiments, the controller cluster will not drop an MFN from the listunless another MFN has a 10% smaller average weight for a window (e.g.,a time period) of measurements.

As mentioned above, the particular MMCN edge node in some embodimentsmaintains a secure connection (e.g., an IPsec connection) to the virtualnetwork gateway of each of the M MFNs. In some embodiments, thecontroller cluster directs (at 2425) the particular MMCN edge node toestablish secure connections with each of the M MFNs. At 2430, thecontroller cluster uses the computed weights of the selected M MFNs toidentify optimal routes and failover routes for connecting theparticular MMCN edge node with each other possible nodes for datamessage flows to traverse between the particular MMCN edge node andother MMCN edge nodes or SaaS provider datacenters through the virtualnetwork. To generate such routes, the controller cluster in someembodiments uses shortest path route-identification processes, asdescribed above.

In some embodiments, the controller cluster repeats its routeidentification process periodically, or whenever the computed weightvalues change (e.g., based on new measurements or addition/deletion ofMFNs in the list of M MFNs). In some embodiments, the controller clusterperforms the route identification operation (at 2430) for the particularMMCN edge node along with the route identification operation for othermulti-homed MMCNs and/or multi-homed SaaS providers together, asmultiple connection links to other MMCNs and to the SaaS providers wouldbe relevant in identifying optimal routes to and from the particularMMCN. These computed routes also account for routes to/from virtualnetwork MFNs that are candidates for connecting to remote devices (e.g.,remote laptops, desktops, or mobile devices, such as smartphones,tablets, etc.).

After identifying these routes, the controller cluster supplies (at2435) forwarding records for one or more routes to the particular MMCNedge node and the MFNs. For instance, in some embodiments, thecontroller cluster provides forwarding records (e.g., routing recordsthat specify the next hop, routing records that specify the virtualnetwork egress node, etc.) to particular MMCN edge node and to the MFNCFEs. By using these forwarding records to perform their routingoperations, the particular MMCN edge node and MFN CFEs implement theoptimal and failover routes defined (at 2430) by the controller cluster.In some embodiments, the controller cluster supplies new routing recordsto the particular MMCN edge node and the MFN CFEs whenever it identifiesnew optimal or failover routes.

In this manner, the process 2400 of FIG. 24 bases its routingcomputations on computed weight values that express the quality of theconnection between the particular MMCN and each of its severalconnections to the virtual network. Under this approach, a differentvirtual-network ingress/egress node pair can be selected for theparticular MMCN edge node and different MMCNs, different SaaS nodesand/or different remote devices. Because of this, the controller clusterin some embodiments performs the route identification operation (i.e.,operation 2430) for one or more multi-homed MMCNs and/or multi-homedSaaS providers together, as mentioned above.

FIG. 25 presents an example of two branch nodes EN1 and EN2 of two MMCNs2505 and 2510 and a SaaS datacenter 2515. Each of the branch nodesconnects to the virtual network 2520 through virtual-network MFNs2525-2535 that are defined in three public cloud datacenters of two orthree public cloud providers. The SaaS datacenter 2515, on the otherhand, can be accesses through virtual-network MFNs 2540 and 2545. Theweight measured between the relevant branch nodes EN1 and EN2, MFNs2525-2545 and SaaS datacenter 2515 are depicted on the links betweenthese nodes. In this example, it is assumed that other weights, likebetween nodes 2525 and 2535 are much higher (e.g. 10), so that noshortest path routing algorithm will use them in the best cost path.

As can be seen from this example, the best path from EN1 to the SaaSdatacenter traverses nodes 2525 and 2540 as this path has a weight sumof 14, which is smaller than other weight costs of other paths. Forinstance, going through node 2530 will incur a smaller weight in thefirst hop but will result in a total minimal weight of 15. The optimalroute from branch node EN2 will be through router 2535 and 2545 with atotal weight of 15. Consequently, the two branches will use twodifferent routes to reach the SaaS datacenter. To communicate betweenEN1 and EN2, the best route will be through MFN 2530 with a total weightof 13.

As mentioned above, some embodiments associate two or morevirtual-network MFNs with each SaaS provider's datacenter. SaaS is asoftware distribution model in which a third-party provider hostsapplications and makes them available to customers over the Internet.SaaS removes the need for organizations to install and run applicationson their own computers or in their own datacenters. This eliminates theexpense of hardware acquisition, provisioning and maintenance, as wellas software licensing, installation and support. Also, rather thanpurchasing software to install, or additional hardware to support it,customers subscribe to a SaaS offering. Generally, they pay for thisservice on a monthly basis using a pay-as-you-go model. Transitioningcosts to a recurring operating expense allows many businesses toexercise better and more predictable budgeting. Users can also terminateSaaS offerings at any time to stop those recurring costs.

SaaS offer high scalability, which gives customers the option to accessmore, or fewer, services or features without a need to provision or buymore computers. When there is a need to update the software, rather thanpurchasing new version or update the version the customer own, customerscan rely on a SaaS provider to automatically perform updates and patchmanagement. This further reduces the burden on in-house IT staff. SinceSaaS applications are delivered over the Internet, users can access themfrom any Internet-enabled device and location. These advantages havemade SaaS a very popular alternative to packaged software that isinstalled on customer premises using customer hardware. The SaaSproviders may host the service on one or more servers in its privatedatacenter(s) or on one or more servers residing in one or more regionsin the public cloud.

Typically, the SaaS provider is identified by the domain name of itsservice (e.g. www.myworkday.com). Often, there is a different domainname associated with the servers that run public web page of the SaaSprovider (www.workday.com) than the ones that runs the SaaS application(www.myworkday.com). This domain name can be resolved through a DNSquery to provide the IP address of the SaaS application server.

In case there are multiple servers, the DNS server may return adifferent IP address to two different requests that can be associatedwith different servers. The logic of the different name is from alocation basis. If the SaaS provider has several regions in the worldwhere it owns server, each requester will get back an IP server that iscloser to it. Inside the same region, the DNS service can still selectdifferent servers according to a load balancing point of view; the IPaddress that is returned is associated with a different server in thesame region. This latter case will return IP addresses for differentservers who usually share the same IP subnet.

The controller cluster of the virtual network in some embodiments keepsa table of known IP SaaS addresses. When the virtual network getspackets from a customer, the destination IP can be of three differenttypes. First, the packet can be associated with a private location ofthe entity (i.e., has a destination address in the private IP space ofthe entity). In this situation, the virtual network in some embodimentsroutes the packets to the corresponding compute node of the entity thatis associated with the packet's destination address.

Second, the packet has a destination addressed that is a public (notprivate) IP address that is not known to virtual network. These IPaddresses are referred to as generic public IP addresses. The virtualnetwork in some embodiments sends such a packet to the Internet from theingress virtual network node. Third, the packet has a destinationaddressed that is a public (not private) IP address known to virtualnetwork to be an IP address of a SaaS provider. Such IP addresses arereferred to as SaaS IP addresses. In some embodiments, such a packetwill be routed from a first virtual-network node (e.g., first CFE of afirst MFN) to a second virtual-network node (e.g., second CFE of asecond MFN) from where it is provided to the SaaS IP in the shortestpossible way in some embodiments.

FIG. 26 illustrates a process 2600 used by the central controllercluster of some embodiments to define routes for multi-homed SaaSproviders. This process identifies the various IP addresses associatedwith a SaaS service and identifies the shortest possible routes fromdifferent compute end nodes to one or more SaaS provider datacenters. Asshown, the process 2600 starts (at 2605) in some embodiments when thecontroller cluster receives a SaaS domain name list. In someembodiments, the SaaS domain list is provided by the administrator ofthe public cloud virtual network provider, while in other embodimentsthis list is provided by an administrator of the entity for which thepublic-cloud virtual network is defined by the virtual network provider.The table below provides an example of such a SaaS list.

Name 1. login.adaptiveinsights.com 2. adobeid-na1.services.adobe.com 3.athenanet.athenahealth.com 4. login.bws.birst.com 5. account.box.com 6.centrify.com 7. identity.citrix.com 8. login.constantcontact.com 9.account.docusign.com 10. login.github.com 11. secure.gooddata.com 12.app.hubspot.com 13. login.huddle.net 14. hub.insidesales.com 15.login.marketo.com 16. system.netsuite.com 17. login.newrelic.com 18.login.microsoftonline.com 19. login.okta.com 20. login.oracle.com 21.myapps.paychex.com 22. login.salesforce.com 23.servicemax.cloudforce.com 24. hi.service-now.com 25.auth.tableausoftware.com 26. login.ultimatesoftware.com 27.support.veeva.com 28. login.xero.com 29. www.zendesk.com

At 2610, the controller cluster stores the SaaS domain list in adatabase. In some embodiments, this database is accessible through oneor more interfaces (e.g., web server interface and/or API interface) toadministrators of the virtual network provider and/or of an entity(e.g., a tenant) for which the virtual network is deployed. Through thisinterface, an administrator can add or remove SaaS providers and/orassociated domain names to the list.

Next, at 2615, the controller cluster learns as many possible IPaddresses of SaaS servers associated with the domain on its list ofdomain names. To that end, the controller cluster in some embodimentsdirects different measurement agents 205 in the public clouds (that aredeployed by the VNP for one or more virtual networks deployed overdifferent public clouds) to execute DNS query for each domain name onthe list. Such a query is repeated periodically (e.g. every 30 minutes).The measurement agents 205 transfer back (at 2615) to the controllercluster the IP addresses that they learn for each domain name.

Different measurement agents may return different IP addresses as manySaaS are using geographical DNS service to match an adjacent server withthe client. The SaaS providers typically use Authoritative DNS Serversthat have lists of SaaS servers and their locations. When such a DNSserver gets a DNS request, it receives the measurement agent's IPaddress, and uses this IP address to Geo-IP map to identify the locationof the measurement agent and returns the IP address of the “best” serverfor the measurement agent. In some embodiments, the measurement agentalso provides the IP address of an end-compute node of the virtualnetwork, and the DNS server used by the SaaS provider provides an IPaddress based on the end-compute node's IP address.

The controller cluster stores (at 2620) in a database the returned IPaddresses along with their associated domain names. When at least somenumber of IPs (e.g., 5) belong to the same IP subnet (e.g., class Csubnet that includes 255 or less different addresses), the controllercluster adds the subnet itself to the database. In some embodiments,this database is accessible through one or more interfaces (e.g., webserver interface and/or API interface) to administrators of the virtualnetwork provider and/or of an entity (e.g., a tenant) for which thevirtual network is deployed. Through this interface, an administratorcan add or remove IP addresses. This interface also allows theaddition/removal of records associated with domain names that areadded/removed by an administrator. Also, in some embodiments, thecontroller cluster purges IP addresses that are not reported as beingused for a duration of time (e.g., every day, every several days, everyweek or every several weeks, etc.).

After 2620, the central controller identifies (at 2625) for eachreported IP address that is received from the reporting measurementagents in one or more public clouds (reporting regions), a set of publicclouds (nearby regions) that are near (i.e., within a threshold distanceof) the reporting region. In some embodiments, the nearness of tworegions are determined in terms of network distances that are measuredseparately between the regions. In some embodiments, the process 2600uses third party DNS services to identify an approximate location foreach IP address, and then uses the identified locations of the IPaddresses to quantify a distance between two IP addresses. The list ofthe set of regions identified for all the reported IP address isreferred to as IP vicinity report. When such operation is not done, theIP vicinity report will define all the virtual network regions as beingnear each IP address.

At 2630, the central controller provides the IP vicinity report to thedeployed measurement agents 205 that are deployed by the VNP for one ormore virtual networks deployed over different public clouds. Eachmeasurement agent then periodically measures (e.g., once every severalminutes or several hours) the distance between the measurement agent andeach SaaS provider IP address that is identified as being near themeasurement agent in the IP vicinity report. In some embodiments, themeasurement agent computes this distance to an IP address in terms ofthe delay for initiating a TCP connection with a server at this IPaddress. When the server, having this IP address is responding, the timeto that response is measured. Once a first response is accounted, themeasurement agent actively terminates the TCP connection in someembodiments. In some embodiments, the measurement agent also counts thenumber of successful TCP connection events and/or lost packets. Themeasurement agent in other embodiments uses other measurementtechniques, such as any one of the measurement techniques that weredescribed above.

At 2635, the controller cluster receives the distance measurements fromthe measurement agents. Next, at 2640, the controller cluster uses thereturned measurements (e.g., the delay and loss numbers reported fromeach measurement agent) to identify routes to each SaaS provider (e.g.,to each SaaS IP address) from each possible ingress MFN and/or from eachpossible MMCN. To identify the routes, the controller cluster performsshortest path route-identification process in some embodiments thatrelies on the weight values that are computed based on the measurementsto the different SaaS IP addresses, between different MFNs and to thedifferent MMCNs.

In some embodiments, the controller cluster repeats its routeidentification process periodically, or whenever the computed weightvalues change (e.g., based on new measurements or addition/deletion ofMFNs and SaaS IP addresses). In some embodiments, the controller clusterperforms the route identification operation (at 2640) for the multipleMMCNs and SaaS IP addresses together, as multiple egress nodesassociated with MMCNs and SaaS providers would be relevant inidentifying optimal routes to any one SaaS provider.

After identifying these routes, the controller cluster supplies (at2645) these routes to the MMCN edge nodes and the MFNs. For instance, insome embodiments, the controller cluster provides forwarding records(e.g., routing records that specify the next hop, routing records thatspecify the virtual network egress node, etc.) to the MMCN edge nodesand to the MFN CFEs. By using these forwarding records to perform theirrouting operations, the particular MMCN edge nodes and MFN CFEsimplement the optimal routes defined (at 2640) by the controllercluster. In some embodiments, the controller cluster supplies newrouting records to the MMCN edge nodes and the MFN CFEs whenever itidentifies new routes.

In some embodiments, the SaaS IP addresses that are discovered by theabove process are assumed to have a zero routing distance to the virtualnetwork node to which they connect (i.e., are assumed to be virtuallylocated in a public cloud region of the virtual network). In otherembodiments, the routing links between public cloud regions and SaaS IPaddresses have weights associated with them (as reflected in the exampleof FIG. 25 ), and these weights reflect the cost (e.g., measured delayand/or loss) associated with the path from those public cloud regions tothe SaaS IP addresses. Under this approach, the best regions to connectto a particular IP address are the regions from which the computedweight values (i.e., the cost measured in terms of packet delay andloss) are small.

One rational for associating a SaaS IP address with more than one MFNCFE in more than one public cloud region is that the distance of theSaaS server to multiple regions is much smaller than the typicaldistance between regions. In addition, it might cost less to routetraffic that is originating in one public cloud so it will stay till theegress node in the same cloud. In this case, the controller cluster insome embodiments binds each SaaS IP to at least one region in eachpublic cloud as long as the cost (e.g., the delay and loss) from thenearest region is below some cost (e.g., the delay and loss) threshold.When the route identification process needs to calculate a shortest pathto a certain IP address, it first looks to which regions this IP addressis bound, then it computes the shortest path from each egress node tothe bound region. In some embodiments, the routing tables themselves inthe routers do not need to include the external IP address as the datamessage will be carried in the tunnels until the destination egressnode, which then will look up to the IP address in the tunnel.

As mentioned above, the computed weight value in some embodimentsaccounts for the cost of packet delay and/or loss in a link between twopublic clouds regions, between a public cloud region and a SaaS providerdatacenter, or between a public cloud region and a tenant's compute endnode. In other embodiments, the computed weight value for each such linkis computed in terms of other types of parameters, such as the datathroughput costs that are charged by the public cloud providers and/orthe compute cost (for the compute elements used to implement the MFNcomponents in the public cloud) that are charged by the public cloudproviders.

Many of the above-described features and applications are implemented assoftware processes that are specified as a set of instructions recordedon a computer readable storage medium (also referred to as computerreadable medium). When these instructions are executed by one or moreprocessing unit(s) (e.g., one or more processors, cores of processors,or other processing units), they cause the processing unit(s) to performthe actions indicated in the instructions. Examples of computer readablemedia include, but are not limited to, CD-ROMs, flash drives, RAM chips,hard drives, EPROMs, etc. The computer readable media does not includecarrier waves and electronic signals passing wirelessly or over wiredconnections.

In this specification, the term “software” is meant to include firmwareresiding in read-only memory or applications stored in magnetic storage,which can be read into memory for processing by a processor. Also, insome embodiments, multiple software inventions can be implemented assub-parts of a larger program while remaining distinct softwareinventions. In some embodiments, multiple software inventions can alsobe implemented as separate programs. Finally, any combination ofseparate programs that together implement a software invention describedhere is within the scope of the invention. In some embodiments, thesoftware programs, when installed to operate on one or more electronicsystems, define one or more specific machine implementations thatexecute and perform the operations of the software programs.

FIG. 27 conceptually illustrates a computer system 2700 with which someembodiments of the invention are implemented. The computer system 2700can be used to implement any of the above-described hosts, controllers,and managers. As such, it can be used to execute any of the abovedescribed processes. This computer system includes various types ofnon-transitory machine readable media and interfaces for various othertypes of machine readable media. Computer system 2700 includes a bus2705, processing unit(s) 2710, a system memory 2725, a read-only memory2730, a permanent storage device 2735, input devices 2740, and outputdevices 2745.

The bus 2705 collectively represents all system, peripheral, and chipsetbuses that communicatively connect the numerous internal devices of thecomputer system 2700. For instance, the bus 2705 communicativelyconnects the processing unit(s) 2710 with the read-only memory 2730, thesystem memory 2725, and the permanent storage device 2735.

From these various memory units, the processing unit(s) 2710 retrieveinstructions to execute and data to process in order to execute theprocesses of the invention. The processing unit(s) may be a singleprocessor or a multi-core processor in different embodiments. Theread-only-memory (ROM) 2730 stores static data and instructions that areneeded by the processing unit(s) 2710 and other modules of the computersystem. The permanent storage device 2735, on the other hand, is aread-and-write memory device. This device is a non-volatile memory unitthat stores instructions and data even when the computer system 2700 isoff. Some embodiments of the invention use a mass-storage device (suchas a magnetic or optical disk and its corresponding disk drive) as thepermanent storage device 2735.

Other embodiments use a removable storage device (such as a floppy disk,flash drive, etc.) as the permanent storage device. Like the permanentstorage device 2735, the system memory 2725 is a read-and-write memorydevice. However, unlike storage device 2735, the system memory is avolatile read-and-write memory, such a random access memory. The systemmemory stores some of the instructions and data that the processor needsat runtime. In some embodiments, the invention's processes are stored inthe system memory 2725, the permanent storage device 2735, and/or theread-only memory 2730. From these various memory units, the processingunit(s) 2710 retrieve instructions to execute and data to process inorder to execute the processes of some embodiments.

The bus 2705 also connects to the input and output devices 2740 and2745. The input devices enable the user to communicate information andselect commands to the computer system. The input devices 2740 includealphanumeric keyboards and pointing devices (also called “cursor controldevices”). The output devices 2745 display images generated by thecomputer system. The output devices include printers and displaydevices, such as cathode ray tubes (CRT) or liquid crystal displays(LCD). Some embodiments include devices such as a touchscreen thatfunction as both input and output devices.

Finally, as shown in FIG. 27 , bus 2705 also couples computer system2700 to a network 2765 through a network adapter (not shown). In thismanner, the computer can be a part of a network of computers (such as alocal area network (“LAN”), a wide area network (“WAN”), or an Intranet,or a network of networks, such as the Internet. Any or all components ofcomputer system 2700 may be used in conjunction with the invention.

Some embodiments include electronic components, such as microprocessors,storage and memory that store computer program instructions in amachine-readable or computer-readable medium (alternatively referred toas computer-readable storage media, machine-readable media, ormachine-readable storage media). Some examples of such computer-readablemedia include RAM, ROM, read-only compact discs (CD-ROM), recordablecompact discs (CD-R), rewritable compact discs (CD-RW), read-onlydigital versatile discs (e.g., DVD-ROM, dual-layer DVD-ROM), a varietyof recordable/rewritable DVDs (e.g., DVD-RAM, DVD-RW, DVD+RW, etc.),flash memory (e.g., SD cards, mini-SD cards, micro-SD cards, etc.),magnetic and/or solid state hard drives, read-only and recordableBlu-Ray® discs, ultra-density optical discs, any other optical ormagnetic media, and floppy disks. The computer-readable media may storea computer program that is executable by at least one processing unitand includes sets of instructions for performing various operations.Examples of computer programs or computer code include machine code,such as is produced by a compiler, and files including higher-level codethat are executed by a computer, an electronic component, or amicroprocessor using an interpreter.

While the above discussion primarily refers to microprocessor ormulti-core processors that execute software, some embodiments areperformed by one or more integrated circuits, such as applicationspecific integrated circuits (ASICs) or field programmable gate arrays(FPGAs). In some embodiments, such integrated circuits executeinstructions that are stored on the circuit itself.

As used in this specification, the terms “computer”, “server”,“processor”, and “memory” all refer to electronic or other technologicaldevices. These terms exclude people or groups of people. For thepurposes of the specification, the terms display or displaying meansdisplaying on an electronic device. As used in this specification, theterms “computer readable medium,” “computer readable media,” and“machine readable medium” are entirely restricted to tangible, physicalobjects that store information in a form that is readable by a computer.These terms exclude any wireless signals, wired download signals, andany other ephemeral or transitory signals.

While the invention has been described with reference to numerousspecific details, one of ordinary skill in the art will recognize thatthe invention can be embodied in other specific forms without departingfrom the spirit of the invention. For instance, several of theabove-described examples illustrate virtual corporate WANs of corporatetenants of a virtual network provider. One of ordinary skill willrealize that in some embodiments, the virtual network provider deploysvirtual networks over several public cloud datacenters of one or morepublic cloud providers for non-corporate tenants (e.g., for schools,colleges, universities, non-profit entities, etc.). These virtualnetworks are virtual WANs that connect multiple compute endpoints (e.g.,offices, datacenters, computers and devices of remote users, etc.) ofthe non-corporate entities.

Several embodiments described above include various pieces of data inthe overlay encapsulation headers. One of ordinary skill will realizethat other embodiments might not use the encapsulation headers to relayall of this data. For instance, instead of including the tenantidentifier in the overlay encapsulation header, other embodiments derivethe tenant identifier from the addresses of the CFEs that forward thedata messages, e.g., in some embodiments in which different tenants havetheir own MFNs deployed in the public clouds, the tenant identity isassociated with the MFN's that process the tenant messages.

Also, several figures conceptually illustrate processes of someembodiments of the invention. In other embodiments, the specificoperations of these processes may not be performed in the exact ordershown and described in these figures. The specific operations may not beperformed in one continuous series of operations, and different specificoperations may be performed in different embodiments. Furthermore, theprocess could be implemented using several sub-processes, or as part ofa larger macro process. Thus, one of ordinary skill in the art wouldunderstand that the invention is not to be limited by the foregoingillustrative details, but rather is to be defined by the appendedclaims.

We claim:
 1. A method for defining multiple routes to a SaaS (Softwareas a Service) provider through a virtual network defined by a pluralityof managed routers deployed in a set of one or more one public clouds,the method comprising: providing, to each of a plurality of measurementagents deployed in the set of public clouds, an identifier identifyingthe SaaS provider for the measurement agent to generate a measurementthat quantifies an attribute of a network path between the measurementagent and the identified SaaS provider, wherein the identifier for theSaaS provider is a network address associated with a set of one or moredatacenters of the SaaS provider; receiving, from each measurementagent, measurements for the identified SaaS provider; based on thereceived measurements, selecting a set of at least two managedforwarding nodes (MFNs), deployed in one or more public clouds of theset of public clouds, to use to reach the SaaS provider from the virtualnetwork; and using the selected set of at least two MFNs to defineroutes through the virtual network to the SaaS provider.
 2. The methodof claim 1, wherein providing, to each of the plurality of measurementagents, an identifier identifying the SaaS provider comprises providing,to each of the plurality of measurement agents, identifiers identifyinga plurality of SaaS providers for the measurement agent to generate ameasurement that quantifies an attribute of a connection between an MFNassociated with the measurement agent and each identified SaaS providerdatacenter, and selecting the set of at least two MFNs to use to reachthe SaaS provider comprises for each of a set of the SaaS providers,selecting at least two MFNs to use to reach the SaaS provider.
 3. Themethod of claim 2, wherein the virtual network is for an entity, andselecting the set of MFNs for each SaaS provider comprises: generating arouting graph for identifying routes from compute nodes of the entitythat are external to the virtual network to each SaaS provider throughthe virtual network; using the received measurements to compute weightsof links in the routing graph; and using the routing graph to performroute-identifying process to identify routes to the SaaS providers thatuse for each SaaS provider the set of MFNs for that SaaS provider. 4.The method of claim 3 further comprising providing the routes to MFNsused to define the virtual network and to at least one multi-computernode of the entity that is external to the virtual network, each routeidentifying a next hop for traversing a routing path to a SaaS providerfrom the MCN or a routing path to a SaaS provider.
 5. The method ofclaim 1, wherein each measurement agent generates a plurality ofmeasurements regarding a plurality of attributes associated with thepath between the public cloud in which the measurement agent is deployedand the SaaS provider, the method further comprising computing a weightvalue for the path between each measurement agent's public cloud and theSaaS provider based on the plurality of measurements received from themeasurement agents.
 6. The method of claim 5, wherein the plurality ofmeasurements comprises message loss rate and message delay for the pathbetween the SaaS provider and each MFN.
 7. The method of claim 6,wherein the plurality of measurements further comprises financial costassociated with the path between the SaaS provider and each MFN.
 8. Themethod of claim 1, wherein each measurement agent has, in a same publiccloud, at least one associated managed router for forwarding messages tothe SaaS provider.
 9. A non-transitory machine readable medium storing aprogram for defining multiple routes to a SaaS (Software as a Service)provider through a virtual network defined by a plurality of managedrouters deployed in a set of one or more one public clouds, the programcomprising sets of instructions for: providing, to each of a pluralityof measurement agents deployed in the set of public clouds, anidentifier identifying the SaaS provider for the measurement agent togenerate a measurement that quantifies an attribute of a network pathbetween the measurement agent and the identified SaaS provider, whereinthe identifier for the SaaS provider is a network address associatedwith a set of one or more datacenters of the SaaS provider; receiving,from each measurement agent, measurements for the identified SaaSprovider; based on the received measurements, selecting a set of atleast two managed forwarding nodes (MFNs), deployed in one or morepublic clouds of the set of public clouds, to use to reach the SaaSprovider from the virtual network; and using the selected set of atleast two MFNs to define routes through the virtual network to the SaaSprovider.
 10. The non-transitory machine readable medium of claim 9,wherein: the set of instructions for providing, to each of the pluralityof measurement agents, an identifier identifying the SaaS providercomprises a set of instructions for providing, to each of the pluralityof measurement agents, identifiers identifying a plurality of SaaSproviders for the measurement agent to generate a measurement thatquantifies an attribute of a connection between an MFN associated withthe measurement agent and each identified SaaS provider datacenter, andthe set of instructions for selecting the set of at least two MFNs touse to reach the SaaS provider comprises for each of a set of the SaaSproviders, a set of instructions for selecting at least two MFNs to useto reach the SaaS provider.
 11. The non-transitory machine readablemedium of claim 10, wherein the virtual network is for an entity, andthe set of instructions for selecting the set of MFNs for each SaaSprovider comprises sets of instructions for: generating a routing graphfor identifying routes from compute nodes of the entity that areexternal to the virtual network to each SaaS provider through thevirtual network; using the received measurements to compute weights oflinks in the routing graph; and using the routing graph to performroute-identifying process to identify routes to the SaaS providers thatuse for each SaaS provider the set of MFNs for that SaaS provider. 12.The non-transitory machine readable medium of claim 11 furthercomprising a set of instructions for providing the routes to MFNs usedto define the virtual network and to at least one multi-computer node ofthe entity that is external to the virtual network, each routeidentifying a next hop for traversing a routing path to a SaaS providerfrom the MCN or a routing path to a SaaS provider.
 13. Thenon-transitory machine readable medium of claim 9, wherein eachmeasurement agent generates a plurality of measurements regarding aplurality of attributes associated with the path between the publiccloud in which the measurement agent is deployed and the SaaS provider,the program further comprising a set of instructions for computing aweight value for the path between each measurement agent's public cloudand the SaaS provider based on the plurality of measurements receivedfrom the measurement agents.
 14. The non-transitory machine readablemedium of claim 13, wherein the plurality of measurements comprisesmessage loss rate and message delay for the path between the SaaSprovider and each MFN.
 15. The non-transitory machine readable medium ofclaim 14, wherein the plurality of measurements further comprisesfinancial cost associated with the path between the SaaS provider andeach MFN.
 16. The non-transitory machine readable medium of claim 9,wherein each measurement agent has, in a same public cloud, at least oneassociated managed router for forwarding messages to the SaaS provider.